Repository navigation
ate-setup: let extra SPIFFE IDs hold the egress_gateway role - #3393
Closed
Max Thompson (thompsonmax) wants to merge 6 commits into
Closed
Max Thompson (thompsonmax) wants to merge 6 commits into
Max Thompson (thompsonmax) wants to merge 6 commits into
Conversation
Add a credential_minter system role that may mint actor JWTs and nothing else. ate-api-server grants it to --credential-minter-spiffe-id, which defaults to the credential-minter ServiceAccount in the install's namespace. Access policies cannot grant it, and an empty flag grants it to no one. A credential plugin that exchanges actor JWTs for cloud access tokens can then run as its own Deployment instead of inside the atenet-egress pod. Anyone who can run a pod as an arbitrary ServiceAccount in the install's namespace can already run one as atenet-egress, so the default grants no new authority. Signed-off-by: Max Thompson <maxthomp@google.com>
Replace --credential-minter-spiffe-id with --credential-minter-spiffe-ids so more than one credential plugin can hold the credential_minter role. The default is still the credential-minter ServiceAccount in the install's namespace, and an empty list grants the role to no one. Signed-off-by: Max Thompson <maxthomp@google.com>
--egress-gateway-spiffe-id now takes a list, comma-separated or repeated, and grants egress_gateway to every ID in it. A credential plugin that exchanges actor JWTs for cloud access tokens can then run as its own Deployment instead of inside the atenet-egress pod. The default is still atenet-egress alone, and an empty list fails startup. Signed-off-by: Max Thompson <maxthomp@google.com>
Make --egress-gateway-spiffe-id a StringArray so each value is one SPIFFE ID. StringSlice also split values on commas. Signed-off-by: Max Thompson <maxthomp@google.com>
Move the arg rewrite out of setAPIServerAuthzArgs into setAPIServerFlag so other settings can render ate-api-server flags. Signed-off-by: Max Thompson <maxthomp@google.com>
ATE_EGRESS_GATEWAY_EXTRA_SPIFFE_IDS lists SPIFFE IDs that hold ate-api-server's egress_gateway role next to atenet-egress, such as a credential provider that mints actor JWTs. ate-setup passes atenet-egress first because --egress-gateway-spiffe-id replaces its default when set. Signed-off-by: Max Thompson <maxthomp@google.com>
Max Thompson (thompsonmax)
force-pushed
the
egress-gateway-extra-spiffe-ids
branch
from
October 28, 2026 18:18
0488f7a to
8e335d4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Depends on #3360. Review the last two commits until it merges.
Part of #1661.
Credential providers that exchange actor JWTs for cloud tokens need to call
MintActorJwtunder their own identity. #3360 makes ate-api-server's--egress-gateway-spiffe-idrepeatable. This addsATE_EGRESS_GATEWAY_EXTRA_SPIFFE_IDSso ate-setup can set it, since ate-setup owns ate-api-server's args. atenet-egress is always passed first. Unset leaves the flag off.Each listed ID gets the whole
egress_gatewayrole, including reading actors and minting actor certificates.AI use: AI-assisted, I reviewed and tested it.