Function resolve_credentials

nodedb/src/control/cluster/tls.rs:67–146

Resolve [`TransportCredentials`] for this node from operator settings and on-disk state. See module docs for resolution order.

(
    settings: &ClusterSettings,
    data_dir: &Path,
)

/// Resolve [`TransportCredentials`] for this node from operator settings
/// and on-disk state. See module docs for resolution order.
pub fn resolve_credentials(
    settings: &ClusterSettings,
    data_dir: &Path,
) -> crate::Result<TransportCredentials> {
    if settings.insecure_transport {
        warn!(
            node_id = settings.node_id,
            "cluster.insecure_transport = true — channel authentication DISABLED. \
             This is safe only on fully isolated private networks."
        );
        return Ok(TransportCredentials::Insecure);
    }

    let tls_dir = data_dir.join(TLS_SUBDIR);

    if let Some(paths) = &settings.tls {
        let creds = load_from_paths(paths, &tls_dir)?;
        info!(
            node_id = settings.node_id,
            cert = %paths.cert.display(),
            "cluster TLS credentials loaded from operator-provided paths"
        );
        return Ok(TransportCredentials::Mtls(creds));
    }

    if tls_dir.join(NODE_CERT_FILE).exists()
        && tls_dir.join(NODE_KEY_FILE).exists()
        && tls_dir.join(CA_CERT_FILE).exists()
        && tls_dir.join(CLUSTER_SECRET_FILE).exists()
    {
        let creds = load_from_data_dir(&tls_dir)?;
        info!(
            node_id = settings.node_id,
            dir = %tls_dir.display(),
            "cluster TLS credentials loaded from data dir"
        );
        return Ok(TransportCredentials::Mtls(creds));
    }

    if is_bootstrapping_node(settings) {
        let creds = bootstrap_credentials(settings, &tls_dir)?;
        info!(
            node_id = settings.node_id,
            dir = %tls_dir.display(),
            "bootstrapped new cluster CA + node credentials"
        );
        return Ok(TransportCredentials::Mtls(creds));
    }

    // L.4: token-authenticated cred delivery. When the operator
    // exports `NODEDB_JOIN_TOKEN=<hex>` and `NODEDB_JOIN_SEED=<addr>`,
    // reach out to the seed's bootstrap listener, fetch the cred
    // bundle, write it to `tls/`, and fall through to the normal
    // `load_from_data_dir` path on the next pass. The env-driven
    // spelling keeps joiners' config files identical to bootstrappers'
    // — only the startup environment differs.
    if let (Ok(token), Ok(seed_str)) = (
        std::env::var("NODEDB_JOIN_TOKEN"),