d273fa8028
secrets.md and credentials-reference.md answered the same question from two pages. secrets.md's text now follows the reference's table and operating notes as a 'Where each secret lives' section, unchanged apart from where it sits. Every link and doc path that named secrets.md (docs, nix comments, crate READMEs) points at credentials-reference.md; anchors are unchanged.
27 lines
1.3 KiB
Markdown
27 lines
1.3 KiB
Markdown
# Credentials: the target shape
|
|
|
|
<!-- vale write-good.Passive = NO -->
|
|
|
|
The swarm's credential store is bao. This page is the overview of how the swarm
|
|
treats credentials; [`credentials-reference.md`](credentials-reference.md) lists
|
|
each one: who mints it, who reads it, and how it renews, with the notes for
|
|
operating them. It describes the target, not what's on disk today; the reference also
|
|
maps [the files that exist right now](credentials-reference.md#where-each-secret-lives).
|
|
|
|
<!-- vale write-good.Passive = YES -->
|
|
|
|
**Store secrets stay off disk.** A process pulls a value from the store at
|
|
runtime and holds it in memory only.
|
|
|
|
**The mTLS client certificate is the only credential on disk.** Each
|
|
identity (an agent, a hive, a swarm-level service) has one. It's what logs a
|
|
principal in to the store, so you place a hive's or service's certificate by
|
|
hand. The nix option for it takes a path to the certificate, never its bytes,
|
|
because a literal in a nix expression lands in the world-readable nix store.
|
|
A hive hands each agent its certificate; the agent pulls everything else
|
|
itself.
|
|
|
|
**Each credential has a minter, a reader and a renewal story.** Who mints it, who
|
|
reads it, and whether it renews without an operator are what the
|
|
[reference table](credentials-reference.md) gives for every credential, with the
|
|
operating notes that go with them.
|