atlas
7d24feaf25
swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE ...
`swarmctl login` (and any `--swarm` verb) on a controller host failed TLS
with `UnknownIssuer` against the swarm's own gateway: its leaf chains to
the store's `pki` root, which no system store holds, and the only way
through was `--ca-file`/`SWARMCTL_CA_FILE` by hand.
The host's swarmctl wrapper now sets `SSL_CERT_FILE` to the bundle the
swarm-controller daemon already trusts (`/run/swarm-controller-ca/
trust-bundle.pem`: system CAs plus the swarm's root), when the gateway is
self-signed. swarmctl's reqwest/rustls resolves roots the same way the
daemon's does, so this is the path the daemon uses to reach the same
gateway. `--set` rather than a default, since a nix shell exports its own
`SSL_CERT_FILE`.
Pointing `SWARMCTL_CA_FILE` at the bundle instead would not work (#5243 ):
`--ca-file` adds each certificate as a root and fails the whole client on
one it can't parse.
Hosts without the controller (an operator laptop) still need `--ca-file`.
Refs #5239
Fixes #5243
2026-10-14 12:49:16 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
nix: split module-eval into per-subsystem checks
2026-09-20 04:25:54 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
subagent, bash: run each subagent run and bash task in its own cgroup
2026-10-13 12:25:27 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: restore agentWith in agent-queue-bao.nix
2026-10-13 14:56:25 +02:00
agents: swap the agent's bao leaf in with one rename
2026-10-11 10:00:43 +02:00
module-eval: agent-user test asserts the heal_own_dir form
2026-10-09 11:30:30 +02:00
swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare
2026-10-13 17:00:56 +02:00
swarmctl: on a controller host, trust the swarm's root without SWARMCTL_CA_FILE
2026-10-14 12:49:16 +02:00
review classifier: run on ACP when the swarm settings choose it
2026-10-14 10:14:36 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm-builder: scope the forge token to the forge, one build at a time, opt-in
2026-10-14 03:30:46 +02:00
glue: the controller's authelia and otel environment moves out of the controller module
2026-10-14 10:15:29 +02:00
swarm-otel: authelia is no longer declared as both a loopback and a published scrape target
2026-10-14 10:28:48 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
hive otel: keep file_storage defined when the collector authenticates upstream
2026-10-14 10:13:58 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: assert the severity table once, not once per tier
2026-09-20 14:23:56 +02:00
module-eval: set the hive-controller option only in tests that need a hive
2026-10-05 09:58:13 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm: refuse swarm.hives keys that are not valid hive identifiers
2026-10-12 21:45:50 +02:00
glue: otel scrape targets for authelia, grafana and nats move out of the services
2026-10-14 01:40:40 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
glue: the secret publisher's authelia-dependent settings move out of the publisher module
2026-10-14 01:52:53 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
module-eval: evaluate shared fixture configs once
2026-10-13 08:14:50 +02:00
swarm-otel: authelia is no longer declared as both a loopback and a published scrape target
2026-10-14 10:28:48 +02:00
swarm-builder: scope the forge token to the forge, one build at a time, opt-in
2026-10-14 03:30:46 +02:00
7d24feaf25