diff --git a/modules/mesh-provisioner-client/go.mod b/modules/mesh-provisioner-client/go.mod index 2d0b5146..66d12cf1 100644 --- a/modules/mesh-provisioner-client/go.mod +++ b/modules/mesh-provisioner-client/go.mod @@ -3,7 +3,7 @@ module mesh-provisioner-client go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 github.com/nats-io/nats-server/v2 v2.11.17 github.com/nats-io/nats.go v1.54.0 golang.org/x/sys v0.48.0 diff --git a/modules/mesh-provisioner-client/go.sum b/modules/mesh-provisioner-client/go.sum index 43cc4ec7..0fd448ad 100644 --- a/modules/mesh-provisioner-client/go.sum +++ b/modules/mesh-provisioner-client/go.sum @@ -1,5 +1,7 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ= git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= diff --git a/modules/mesh-provisioner-client/module.json b/modules/mesh-provisioner-client/module.json index 095128a8..8fca6444 100644 --- a/modules/mesh-provisioner-client/module.json +++ b/modules/mesh-provisioner-client/module.json @@ -7,6 +7,7 @@ "scope": "node" } ], + "core-credentials": true, "own-secrets": { "provisioner-broker": "${dir:state}/broker" }, diff --git a/modules/mesh-provisioner/go.mod b/modules/mesh-provisioner/go.mod index f9cfe363..5727b790 100644 --- a/modules/mesh-provisioner/go.mod +++ b/modules/mesh-provisioner/go.mod @@ -3,7 +3,7 @@ module mesh-provisioner go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 github.com/nats-io/nats.go v1.54.0 ) diff --git a/modules/mesh-provisioner/go.sum b/modules/mesh-provisioner/go.sum index 43cc4ec7..0fd448ad 100644 --- a/modules/mesh-provisioner/go.sum +++ b/modules/mesh-provisioner/go.sum @@ -1,5 +1,7 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ= git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= diff --git a/modules/mesh-provisioner/module.json b/modules/mesh-provisioner/module.json index e14cb7e3..7d5c4d3e 100644 --- a/modules/mesh-provisioner/module.json +++ b/modules/mesh-provisioner/module.json @@ -45,6 +45,7 @@ "plans", "refused" ], + "core-credentials": true, "own-secrets": { "broker": "${dir:state}/broker" }, diff --git a/modules/mesh-vault/cmd/mesh-vault/core.go b/modules/mesh-vault/cmd/mesh-vault/core.go index b0264c61..38fa165a 100644 --- a/modules/mesh-vault/cmd/mesh-vault/core.go +++ b/modules/mesh-vault/cmd/mesh-vault/core.go @@ -24,10 +24,6 @@ import ( "time" ) -// CoreModules are the core's modules whose own secrets the controller carries sealed by the vault: the same fixed -// list as the controller's (ADR 0349 §16). The node-engine and the controller have no own secrets of their own here. -var CoreModules = []string{"mesh-provisioner", "mesh-provisioner-client", "nats"} - // nodeKeyFile is a machine's sealing key as its engine stated it. type nodeKeyFile struct { Node string `json:"node"` diff --git a/modules/mesh-vault/cmd/mesh-vault/core_test.go b/modules/mesh-vault/cmd/mesh-vault/core_test.go index 5ea24183..e73ce5f7 100644 --- a/modules/mesh-vault/cmd/mesh-vault/core_test.go +++ b/modules/mesh-vault/cmd/mesh-vault/core_test.go @@ -14,7 +14,6 @@ import ( "encoding/pem" "os" "path/filepath" - "reflect" "strings" "sync" "testing" @@ -56,13 +55,6 @@ func clientsBroker(sealingKey string) MoveOf { Generation: "g-1", SealingKey: sealingKey} } -// The list is the controller's (mesh-controller's core list, ADR 0349 §16): named here so a change to either is seen. -func TestTheCoreIsTheBusTheProvisionerAndItsClient(t *testing.T) { - if want := []string{"mesh-provisioner", "mesh-provisioner-client", "nats"}; !reflect.DeepEqual(CoreModules, want) { - t.Fatalf("the core's modules are %v, want %v", CoreModules, want) - } -} - // A node-engine states its machine's sealing key in its own name at the move, and only its own machine's. func TestAMoveRecordsTheSealingKeyItsNodeEngineStates(t *testing.T) { v := newVault(t, nil) diff --git a/modules/mesh-vault/cmd/mesh-vault/move.go b/modules/mesh-vault/cmd/mesh-vault/move.go index 3950af49..269cf31f 100644 --- a/modules/mesh-vault/cmd/mesh-vault/move.go +++ b/modules/mesh-vault/cmd/mesh-vault/move.go @@ -292,7 +292,10 @@ func (v *Vault) StateNodeKey(caller, key string) error { } for _, r := range all { parts := strings.Split(r.Name, "/") - if len(parts) == 4 && parts[0] == "own" && parts[1] == node && slices.Contains(CoreModules, parts[2]) { + // Every own secret of the machine is said changed: which modules carry theirs sealed by the vault is what their + // manifests say (core-credentials), read by the node-engine, which composes again and reseals those alone; the vault + // keeps no list of modules (issue 774, the operator 2026-11-03). + if len(parts) == 4 && parts[0] == "own" && parts[1] == node { v.announce(Changed{Name: r.Name, Generation: r.Generation, At: v.Now().UTC(), By: caller}) } } diff --git a/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go b/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go index cc721a48..cb24e41e 100644 --- a/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go +++ b/modules/mesh-vault/cmd/mesh-vault/nodekey_test.go @@ -2,7 +2,7 @@ package main // Issue 786 (ADR 0372): a machine's node-engine states its own sealing key to the vault, in its own name, at start and // when it changes, whether or not it ever moved a secret in. The caller is the bus user the runtime proved; a changed -// key (or a first one) raises `secret-changed` for the machine's core secrets, the same key says nothing. +// key (or a first one) raises `secret-changed` for the machine's own secrets, the same key says nothing. import ( "git.novox.be/novox/mesh-sdk/go/seal" @@ -76,7 +76,8 @@ func TestANodeEngineStatesItsOwnKeyAndAChangeRaisesItsCoreSecrets(t *testing.T) t.Error("a key was recorded for g14 by ace's engine") } got := changedNames(v.bus)[before:] - want := []string{"own/ace/mesh-provisioner-client/provisioner-broker", "own/ace/nats/broker"} + // Every own secret of the machine: which carry the vault's box their manifests say, read by the node-engine (issue 774). + want := []string{"own/ace/mesh-provisioner-client/provisioner-broker", "own/ace/nats/broker", "own/ace/postgres/superuser-password"} if strings.Join(got, ",") != strings.Join(want, ",") { t.Errorf("secret-changed was raised for %v, want %v", got, want) } @@ -85,16 +86,16 @@ func TestANodeEngineStatesItsOwnKeyAndAChangeRaisesItsCoreSecrets(t *testing.T) if _, err := tool.runAs("node.ace", map[string]any{"key": pub}); err != nil { t.Fatal(err) } - if n := len(changedNames(v.bus)); n != before+2 { - t.Errorf("the same key raised %d more", n-before-2) + if n := len(changedNames(v.bus)); n != before+3 { + t.Errorf("the same key raised %d more", n-before-3) } // A different key raises them again. other, _ := aSealingKey(t) if _, err := tool.runAs("node.ace", map[string]any{"key": other}); err != nil { t.Fatal(err) } - if n := len(changedNames(v.bus)); n != before+4 { - t.Errorf("a changed key raised %d, want 2", n-before-2) + if n := len(changedNames(v.bus)); n != before+6 { + t.Errorf("a changed key raised %d, want 3", n-before-3) } if got, _, _ := v.Store.NodeKey("ace"); got != other { t.Error("the changed key was not recorded") diff --git a/modules/mesh-vault/go.mod b/modules/mesh-vault/go.mod index 1a304645..f0d5892d 100644 --- a/modules/mesh-vault/go.mod +++ b/modules/mesh-vault/go.mod @@ -3,7 +3,7 @@ module mesh-vault go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103142843-f8bd12e4b7b1 + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 github.com/nats-io/nats-server/v2 v2.11.17 github.com/nats-io/nats.go v1.54.0 golang.org/x/crypto v0.57.0 diff --git a/modules/mesh-vault/go.sum b/modules/mesh-vault/go.sum index 0111c9e9..0fd448ad 100644 --- a/modules/mesh-vault/go.sum +++ b/modules/mesh-vault/go.sum @@ -1,5 +1,7 @@ -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103142843-f8bd12e4b7b1 h1:T66tg9T/1hHg6KN/bDScHPT41IHkxLAGGO8VJiAOlb8= -git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103142843-f8bd12e4b7b1/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= diff --git a/modules/nats/go.mod b/modules/nats/go.mod index 68625c89..4a4a8ab0 100644 --- a/modules/nats/go.mod +++ b/modules/nats/go.mod @@ -3,7 +3,7 @@ module nats-tools go 1.26.0 require ( - git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 + git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 github.com/klauspost/compress v1.20.0 github.com/nats-io/nats-server/v2 v2.11.17 github.com/nats-io/nats.go v1.54.0 diff --git a/modules/nats/go.sum b/modules/nats/go.sum index 43cc4ec7..0fd448ad 100644 --- a/modules/nats/go.sum +++ b/modules/nats/go.sum @@ -1,5 +1,7 @@ git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128 h1:aI1DhZAuqVBXbybSqhLNOGX5rUOrn9T0cHNCDUQF7IQ= git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261102191058-f02f142af128/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892 h1:XWorhIHDVECRCYzGbkaexEpJ7v03B9LrZ8IVy7vkUKs= +git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261103103643-4f141ff08892/go.mod h1:ouERNpZizzwZ0HLEtAypsY9FR20FyUgUYRni6J7kVCY= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0= github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI= github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo= diff --git a/modules/nats/module.json b/modules/nats/module.json index 01f36795..8e342bf6 100644 --- a/modules/nats/module.json +++ b/modules/nats/module.json @@ -3,7 +3,7 @@ "version": "1", "upgrade": { "policy": "record", - "why": "the bus: replaced only as a planned step a person starts (`bus upgrade`), its streams snapshotted first and checked after (hq ADR 0236); the controller holds this whatever is said here" + "why": "the bus keeps the streams of the whole mesh: it moves on the operator's Approve of its release, its streams snapshotted first (hq ADR 0236, ADR 0599)" }, "provides": [ { @@ -21,6 +21,7 @@ } ], "bus-users": "/var/lib/nats-module/conf/accounts.conf", + "core-credentials": true, "own-secrets": { "broker": "${dir:mesh-state}/broker", "broker-nats-tools": "${dir:tools-secret}/broker-nats-tools"