Skip to main content
← Back to list
01Issue
BugOpenSwamp CLIPublic
AssigneesNone

Relationships

#2193 worker connect --ca-cert is not applied to the data plane; dispatches fail with 'fetch failed' unless DENO_CERT is set

Opened by keeb · 9/16/2026

Summary

swamp worker connect --ca-cert <file> / SWAMP_CA_CERT is honored for the worker's control socket but not for the data plane. Dispatches executed by the worker's child runner fetch from the orchestrator's data-plane URL with the default fetch, which does not carry the configured CA. Against a serve instance using a private CA (the default self-signed cert in Kubernetes setups), the worker enrolls successfully and then every dispatch fails with fetch failed. Setting DENO_CERT works around it, which is the same symptom #1794 fixed for the control connection.

Reproduction

  1. swamp serve with a self-signed cert, --auth-mode token.
  2. swamp worker connect --ca-cert ca.pem ... (no DENO_CERT) — worker enrolls and shows connected.
  3. Run a workflow step placed on the worker → step fails with fetch failed.
  4. Repeat with DENO_CERT=ca.pem → succeeds.

Observed on 20260911.215321 (d18f2d86); unchanged at 34d98319.

Where

  • src/cli/commands/worker_connect.ts passes caCerts: getEnvCaCerts() into src/worker/connect.ts, which builds a Deno.createHttpClient({ caCerts }) for the control socket only.
  • src/worker/exec_dispatch.ts constructs DataPlaneClient without a fetchImpl, so src/worker/data_plane_client.ts falls back to global fetch (no custom CA). The CA path is also not propagated in the dispatch bootstrap parameters to the child runner.

Fix approach

Carry the resolved CA material (or path) from worker connect into the dispatch runner bootstrap and build the DataPlaneClient with an HTTP client configured with those CA certs, so one --ca-cert covers both control and data planes. Add a test that a dispatch data-plane request uses the configured CA, and update the worker-commands TLS reference to stop implying DENO_CERT is needed.

02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED

Open

9/16/2026, 6:26:23 PM

No activity in this phase yet.

03Sludge Pulse

Sign in to post a ripple.