Add support for PSK to remote CIB and deprecate insecure methods#4051

Merged

clumens merged 19 commits intoClusterLabs:mainfrom

clumens:remote-cib-psk

Apr 22, 2026

Commits on Apr 10, 2026

Refactor: libcrmcommon: Make client PSK initialization more obvious.
clumens
committed
Refactor: libcrmcommon: pcmk__tls_client_add_psk_key should take a username.
clumens
committed
Refactor: daemons: Make execd PSK initialization more obvious.
clumens
committed

Commits on Apr 17, 2026

Feature: daemons: Add support for PSK authentication for remote CIB ops.
clumens
committed
Refactor: libcrmcommon: Add a raw param to pcmk__tls_client_add_psk_key.
clumens
committed
Refactor: libcrmcommon: Add a raw param to pcmk__load_key.
clumens
committed
Feature: libcib: Add support for PSK authentication for remote CIB ops.
clumens
committed
Doc: sysconfig: Remove a redundant sentence from PCMK_authkey_location.
clumens
committed
Doc: Pacemaker Explained: Remove a redundant sentence from PCMK_authkey_location.
clumens
committed
Doc: Pacemaker Administration: Document remote CIB admin with PSK.
clumens
committed
Test: cts-scheduler: Remove remote-clear-port from test XML files.
clumens
committed
API: libcrmcommon: Deprecate remote-clear-port.
clumens
committed
Feature: libcrmcommon: Deprecate anonymous authentication.
clumens
committed
Refactor: libcib: Use pcmk__xe_set_props in cib_tls_signon.
clumens
committed
Refactor: libcib: Clean up includes in cib_remote.c
clumens
committed
Refactor: libcrmcommon: The tls_rc argument can no longer be NULL.
clumens
committed
Refactor: libcrmcommon: Always set gnutls_rc on gnutls errors...
clumens
committed
Refactor: libcib: Return more definite errors from cib_tls_signon.
clumens
committed
Refactor: libcib: Split TLS setup out into its own function.
clumens
committed