a cloud simple pair cannot get its database certificate when a third node holds the root CA #105

New issue

Closed

opened 2026-10-08 21:03:50 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-08 21:03:50 -03:00

(Migrated from github.com)

Found in the real-node test of the MariaDB pair, keel 0.23.3 (finding B1).

ID	Severity	Problem	Output
B1	High	In a mesh whose root CA is held by a cloud advanced node (web-1), a cloud simple pair cannot get its database certificate. `/var/lib/keel/etcd/holder` is written only on etcd members, so the node asks the other pair member, which refuses. docs/replication.md covers only the case where a pair member made the mesh.	`the root CA's holder at fd11:a58a:88ef:0:cd53:dda9:f0cb:b889 did not sign the database certificate ([...]:51821 refused: this node does not hold the mesh's root CA)`

Evidence: Keel-Linux/handbook#60, docs/evidence/2026-10-08-mariadb-pair-real.md.

Found in the real-node test of the MariaDB pair, keel 0.23.3 (finding B1). | ID | Severity | Problem | Output | |---|---|---|---| | B1 | High | In a mesh whose root CA is held by a cloud advanced node (web-1), a cloud simple pair cannot get its database certificate. `/var/lib/keel/etcd/holder` is written only on etcd members, so the node asks the other pair member, which refuses. docs/replication.md covers only the case where a pair member made the mesh. | `the root CA's holder at fd11:a58a:88ef:0:cd53:dda9:f0cb:b889 did not sign the database certificate ([...]:51821 refused: this node does not hold the mesh's root CA)` | Evidence: Keel-Linux/handbook#60, docs/evidence/2026-10-08-mariadb-pair-real.md.