A client's use or non-use participation in managed grids is an implicit function of the [grid_management_certificates] configuration #3979

New Issue

exarkun · 2023-02-23T21:26:47Z

exarkun commented

2023-02-23 21:26:47 +00:00

A client can be configured to use the "grid management" feature which controls which servers it will consider valid upload targets.

The way a client is configured to require a signed storage server certificate is by adding grid manager certificates to grid_management_certificates. If the section is missing or contains no certificates then grid management is disabled and the client will upload to any server. If the section contains at least one entry then the client will only upload to a server which presents a certificate which is signed by one of the entries.

The implicit switch in behaviors between zero manager certificates and more-than-zero manager certificates is a usability concern. One might expect that having an empty (but not missing) grid_management_certificates section would mean that valid certificates are required but no authorities are respected. Or one might expect that one a client has opted in to grid management it remains opted in instead of opting out as soon as there are no manager certificates.

A usability improvement to this would be to have an explicit configuration item for controlling whether the client is using grid management or not. This could be something like:

client
# Zero or one of the following
upload_to = managed_grids
upload_to = all_servers

with the "all_servers" behavior being the default (if not indefinitely then at least for a while, for backwards compatibility).

Currently this ticket is speculative. The grid manager feature has not yet been merged to master. The ticket for the work is /tahoe-lafs/trac-2024-07-25/issues/7730.

A client can be configured to use the "grid management" feature which controls which servers it will consider valid upload targets. The way a client is configured to require a signed storage server certificate is by adding grid manager certificates to `grid_management_certificates`. If the section is missing or contains no certificates then grid management is disabled and the client will upload to any server. If the section contains at least one entry then the client will only upload to a server which presents a certificate which is signed by one of the entries. The implicit switch in behaviors between zero manager certificates and more-than-zero manager certificates is a usability concern. One might expect that having an empty (but not missing) `grid_management_certificates` section would mean that valid certificates are required but no authorities are respected. Or one might expect that one a client has opted in to grid management it remains opted in instead of opting out as soon as there are no manager certificates. A usability improvement to this would be to have an explicit configuration item for controlling whether the client is using grid management or not. This could be something like: ``` client # Zero or one of the following upload_to = managed_grids upload_to = all_servers ``` with the "all_servers" behavior being the default (if not indefinitely then at least for a while, for backwards compatibility). Currently this ticket is speculative. The grid manager feature has not yet been merged to master. The ticket for the work is [/tahoe-lafs/trac-2024-07-25/issues/7730](/tahoe-lafs/trac-2024-07-25/issues/7730).

A client's use or non-use participation in managed grids is an implicit function of the [grid_management_certificates] configuration #3979

A client's use or non-use participation in managed grids is an implicit function of the `[grid_management_certificates]` configuration #3979