d273fa8028
secrets.md and credentials-reference.md answered the same question from two pages. secrets.md's text now follows the reference's table and operating notes as a 'Where each secret lives' section, unchanged apart from where it sits. Every link and doc path that named secrets.md (docs, nix comments, crate READMEs) points at credentials-reference.md; anchors are unchanged.
1.3 KiB
Credentials: the target shape
The swarm's credential store is bao. This page is the overview of how the swarm
treats credentials; credentials-reference.md lists
each one: who mints it, who reads it, and how it renews, with the notes for
operating them. It describes the target, not what's on disk today; the reference also
maps the files that exist right now.
Store secrets stay off disk. A process pulls a value from the store at runtime and holds it in memory only.
The mTLS client certificate is the only credential on disk. Each identity (an agent, a hive, a swarm-level service) has one. It's what logs a principal in to the store, so you place a hive's or service's certificate by hand. The nix option for it takes a path to the certificate, never its bytes, because a literal in a nix expression lands in the world-readable nix store. A hive hands each agent its certificate; the agent pulls everything else itself.
Each credential has a minter, a reader and a renewal story. Who mints it, who reads it, and whether it renews without an operator are what the reference table gives for every credential, with the operating notes that go with them.