Repository navigation
a cloud simple pair cannot get its database certificate when a third node holds the root CA #105
Description
Found in the real-node test of the MariaDB pair, keel 0.23.3 (finding B1).
| ID | Severity | Problem | Output |
|---|---|---|---|
| B1 | High | In a mesh whose root CA is held by a cloud advanced node (web-1), a cloud simple pair cannot get its database certificate. /var/lib/keel/etcd/holder is written only on etcd members, so the node asks the other pair member, which refuses. docs/replication.md covers only the case where a pair member made the mesh. |
the root CA's holder at fd11:a58a:88ef:0:cd53:dda9:f0cb:b889 did not sign the database certificate ([...]:51821 refused: this node does not hold the mesh's root CA) |
Evidence: Keel-Linux/handbook#60, docs/evidence/2026-10-08-mariadb-pair-real.md.
Activity