93f1a76ea7
The secret store's pki root issues every hive's gateway leaf and the
swarm's service names, so the root swarm-ca.service generated on the
host anchors nothing and its key is a secret outside the store.
- swarm-ca.nix is gone: swarm-ca.service, root.pem and root-key.pem,
and the swarm.ca.{autoConfigure,stateDir,validityDays} options. A
definition of any of them fails evaluation with a removal message
(swarm-ca-removed.nix), and a tmpfiles rule deletes /var/lib/swarm-ca
on every host. singleHostSwarm no longer sets a swarm.* option.
- hive-tls-ca drops the $root slot: trust-bundle.pem holds the store's
pki root and a hive CA's public ca.pem/ca-previous.pem only.
- hivectl peer-config no longer prints the scp line for the swarm root;
the store's pki root is the one step.
- The gateway's cert import no longer stands a hive leaf or a throwaway
in for a missing swarm-services leaf where it Requires= the issuing
unit: it fails, naming swarm-services-cert.service. The stand-in stays
where the gateway does not wait (no swarm name, or the store's UI
only, whose passthrough must start with the store sealed).
Comments and docs that named swarm-ca.nix, swarm.ca.* or the host root
now name the store's pki root.
Refs #4588
33 lines
1.2 KiB
Nix
33 lines
1.2 KiB
Nix
# Removal shim for `services.hyperhive.swarm.ca.*` and the host-held swarm
|
|
# root it generated.
|
|
#
|
|
# The secret store's `pki` root is the only trust anchor: it issues every
|
|
# hive's gateway leaf and the swarm's service names, and its key never leaves
|
|
# the store. Nothing generates, reads or bundles a root under
|
|
# `/var/lib/swarm-ca`, so a definition of these options fails evaluation with
|
|
# a message, and the directory is deleted on every host.
|
|
#
|
|
# Self-contained and deletable, like ./swarm-peers-removed.nix: one file to
|
|
# remove when the deprecation window closes.
|
|
{ lib, ... }:
|
|
let
|
|
removed =
|
|
name:
|
|
lib.mkRemovedOptionModule [ "services" "hyperhive" "swarm" "ca" name ] ''
|
|
The host-held swarm root CA is gone: the secret store's pki root is the
|
|
only trust anchor, and nothing generates or reads a root under
|
|
/var/lib/swarm-ca. Remove this definition. See docs/swarm/ca.md.
|
|
'';
|
|
in
|
|
{
|
|
imports = map removed [
|
|
"autoConfigure"
|
|
"stateDir"
|
|
"validityDays"
|
|
];
|
|
|
|
# The root's private key is a secret outside the store, and the
|
|
# certificate beside it is an anchor nothing issues under. The option's
|
|
# default path only: a relocated `stateDir` is the operator's to delete.
|
|
systemd.tmpfiles.rules = [ "R /var/lib/swarm-ca" ];
|
|
}
|