spinifex

mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-20 03:11:46 +00:00

Files

T

joshsiv-mulga aa10c19aef fix(ovn): pin OVS system-id to hostname for IPsec cert identity match

ovs-monitor-ipsec uses chassis-id as the IKEv2 `@<name>` peer identity in
the strongSwan config it generates. Our per-node IPsec peer cert
(admin.GenerateIPSecPeerCert) carries the node name as CN + dnsName SAN.
With chassis-id left at the package-generated UUID, charon validates
`@<UUID>` against a cert with dnsName=<hostname> — mismatch returns
AUTHENTICATION_FAILED and no xfrm SAs are negotiated.

Pin system-id to hostname (which equals the node name on Mulga clusters)
by writing both the on-disk source of truth (/etc/openvswitch/system-id.conf,
read by ovs-ctl on boot) and the running OVS DB value. Writing only one
would drift on the next reboot — the original "do not override" comment
was right about that hazard, just wrong about the resolution.

Cross-link the invariant in admin/ipsec.go: changing the cert identity
without updating setup-ovn.sh (or vice versa) breaks IKE silently.

Refs: mulga-siv-136

2026-05-25 20:02:45 +10:00

admin

fix(ovn): pin OVS system-id to hostname for IPsec cert identity match

2026-05-25 20:02:45 +10:00

awsec2query

feat: AWS input validation compliance (#171 )

2026-04-29 11:19:44 +10:00

awserrors

feat: test cleanup (#223 )

2026-05-14 11:40:09 +10:00

config

feat(config): add network.ipsec_enabled cluster flag (default true)