Add scoped cluster API identity and TLS enrollment

toasterson commented

2026-10-01 21:29:49 +00:00

Owner

Workers now enroll with distinct persistent identities over verified TLS. The API scopes node and pod mutations to the enrolled worker, denies unauthorized reads and mutations, and checks pod UID before finalization so stale cleanup cannot delete a replacement. Protected credential files and persisted CA/SAN checks prevent implicit trust rotation.

Work item: 01a0f6e0-dd44-7ef3-b54c-30ff0d5a7ff1 (WI-5).

Validation at exact head bd32be636d: 206 native workspace tests, formatting, strict all-target Clippy/build, disabled SMF validation and all four process smoke suites passed natively on oibldofgate (SunOS/global/root, GCC14, Rust1.97.1, jobs2). Auth tests include real TLS, two worker processes, anonymous/wrong/cross-node denial, stale cleanup UID denial, persistent identity/CA, SAN mismatch, protected file modes, token revocation and rotation. Root source review found no remaining blocker.

Native log SHA256: c5a44777eec740fee893cbcae90f233048881e40ccc28c8f19a323f4e5c55898. Workload execution in these process tests uses mocks; native zone and network proof remains separate in WI-3/WI-4. Canonical Anima AI/CI lifecycle receipts remain separate from this native validation.

Workers now enroll with distinct persistent identities over verified TLS. The API scopes node and pod mutations to the enrolled worker, denies unauthorized reads and mutations, and checks pod UID before finalization so stale cleanup cannot delete a replacement. Protected credential files and persisted CA/SAN checks prevent implicit trust rotation. Work item: 01a0f6e0-dd44-7ef3-b54c-30ff0d5a7ff1 (WI-5). Validation at exact head bd32be636df01d1473ac8659d1b9f076c31d72d6: 206 native workspace tests, formatting, strict all-target Clippy/build, disabled SMF validation and all four process smoke suites passed natively on oibldofgate (SunOS/global/root, GCC14, Rust1.97.1, jobs2). Auth tests include real TLS, two worker processes, anonymous/wrong/cross-node denial, stale cleanup UID denial, persistent identity/CA, SAN mismatch, protected file modes, token revocation and rotation. Root source review found no remaining blocker. Native log SHA256: c5a44777eec740fee893cbcae90f233048881e40ccc28c8f19a323f4e5c55898. Workload execution in these process tests uses mocks; native zone and network proof remains separate in WI-3/WI-4. Canonical Anima AI/CI lifecycle receipts remain separate from this native validation.

toasterson added 2 commits

2026-10-01 21:29:49 +00:00

Authenticate cluster operators and scope enrolled worker API access d38e81dda4

Require worker cleanup generation UID before pod finalization bd32be636d

toasterson merged commit acaa053325 into main

2026-10-01 21:35:44 +00:00

toasterson referenced this pull request from a commit

2026-10-01 21:35:46 +00:00

Merge pull request 'Add scoped cluster API identity and TLS enrollment' (#4) from codex/api-identity-20261001 into main

Rows
Columns

Add scoped cluster API identity and TLS enrollment #4