Repository navigation
agentplane: enable parallel backend TLS listeners - #16333
Open
agentydragon-agent wants to merge 2 commits into
Open
agentydragon-agent wants to merge 2 commits into
agentydragon-agent wants to merge 2 commits into
Conversation
agentydragon
enabled auto-merge (squash)
November 14, 2026 03:02
Contributor
Visual review for
|
Owner
|
Merge-order dependency: merge this only after the images built from #16332 (Policy Controller, Central Sampler, App, Runner Gateway) are pinned on staging. As of 03:24 UTC, the staging pins come from Auto-merge is on, so this merges as soon as CI is green, which could be before that pin. If it lands first, the currently pinned Policy Controller and Central Sampler will reject the new TLS listener settings as unknown keys, and their new Pods will crash-loop until the pin catches up. That is what happened to the Sandbox Controller after #16324 added Generated by Claude Code |
auto-merge was automatically disabled
November 14, 2026 05:18
Head branch was pushed to by a user without write access
agentydragon-agent
force-pushed
the
codex/agentplane-backend-grpc-tls-listeners
branch
3 times, most recently
from
November 14, 2026 06:03
bbfd71b to
b8439cc
Compare
This was referenced Nov 14, 2026
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…6352) Record the current first-party credential, audience, admission, transport and delegation paths, and reconcile the gRPC/workload authentication guidance with the operator’s 2026-11-14 service-SVID decision (#16342). The inventory separates the future Sessions → Runtime proxy hop from proxy → Runtime, and keeps each caller role independent of today’s combined Gateway binary. It records outside-Agentplane Haku routes and the remaining TLS gaps. This is stage 1. It deliberately leaves out issuance, receiver wiring, caller settings and bearer removal; those are separately rolled PRs. #16333/#16334 own the in-flight Policy/sampler TLS changes. The service principal APIs are specified here and implemented separately in #16350. Validation: pre-commit and commit hooks passed. This documentation-only change has no deployment or system-test behavior to exercise; shared auth baseline tests passed in the decision PR. Rollback: revert this documentation PR; no manifests, data or traffic change. ## Questions for Claude Before the later sampler→LLM caller cutover, verify staging Sessions retain execution Identity name and UID for typed delegation. The inventory records that gate; it does not enable the cutover. --------- Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…nt token (#16342) The operator selected service SVIDs over mTLS for every first-party service call on 2026-11-14 (“One auth mode can fire off”). Move PRIVILEGED_BACKEND_AUTH_DESIGN into Unblocked, replace the retained backend TokenReview decision, and make the exit explicit: no Agentplane receiver admits a Kubernetes bearer, including the app’s special agent token. Record the separate app-token removal sequence and freeze Authentik live-test credential provisioning until agents/scripts need staging smoke tests. Certificate issuance, receiver admission, caller cutover and bearer/RBAC removal retain their image-pin and settings rollout gates. #16333 and #16334 remain separate in-flight transport work. Validation: changed-file pre-commit passed after formatting; git diff --check passed. An all-files pre-commit attempt lost the executor connection during markdownlint and did not complete. This is planning-only; no runtime or system-test behavior changes. Rollback: revert this documentation commit; deployed services, settings and credentials are unaffected. Deliberately leaves out implementation, deployment, caller switches, all bearer/code/RBAC removals, and the parked token provisioning. Follow-up PRs stop at stage 3 plus app-agent-token step (a), pending operator image-pin confirmation. ## Questions for Claude None; this records the operator’s decisions and rollout constraints. Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon-agent
force-pushed
the
codex/agentplane-backend-grpc-tls-listeners
branch
from
November 14, 2026 07:42
b8439cc to
ccc6548
Compare
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…16357) Admit exactly configured service SVIDs on the sampler listener, alongside existing bearer accounts. Persist service-owned Sessions using the actual SPIFFE ID in a separate column; the authenticated service never becomes a ServiceAccount UID and cannot reopen an account-owned Session. The schema addition supports overlapping legacy writers. Rebased PR head: `25619ca36759b7f2373fe0cb9a4a5155e06e3411`. This PR targets devel because cross-fork native stacks are unsupported. It reuses #16333’s optional TLS listener, adding client trust before any manifest enables it. Stage 3 only. This deliberately leaves out caller switches, production settings, ownership transfer, outbound History/LLM authentication changes and bearer/RBAC removal. In particular, stage 4 must explicitly handle existing account-owned Sessions rather than map a service to an account UID. The overview diagram records the optional service edge. Validation: pre-commit and commit hooks passed. RPC and Session-store tests passed in [ca8830c5](https://app.buildbuddy.io/invocation/ca8830c5-457d-4d8a-a963-6c0de32a809c), including exact service denial, mixed bearer rejection and separate ownership. Isolated `bbr test` passed for `//agentplane/central_sampler/internal/rpc:unit_test`, `//agentplane/central_sampler/internal/sessionstore:sessionstore_test`, `//agentplane/central_sampler/internal/settings:settings_test`, and `//agentplane/central_sampler:settings` ([invocation](https://app.buildbuddy.io/invocation/2f7d4572-f56b-49a5-b15d-cccd004fa6ac)). Deployment coverage is recorded below. Rollback: before enabling service callers, revert this receiver commit; leave the additive migration applied. Existing account-owned Sessions remain readable by prior images. After service-owned Sessions exist, do not revert to an old binary without a reviewed ownership cutover; the migration down path refuses to orphan them. Check retained Sessions and continuation after rollout. Deployment suite `bbr test //agentplane/system_tests/suites/mcp:test_services` passed (https://app.buildbuddy.io/invocation/b49f4760-c385-4be6-85b7-236af088de77). Rollout gate: no new certificate-path or service-allowlist manifest setting until #16359 merges and the receiver images are pinned. Inactive service defaults are omitted from rendered settings. `bbr test //agentplane/central_sampler:settings //cluster/cdk8s:test_generate_manifests` passed (https://app.buildbuddy.io/invocation/d2ddfa23-2fcc-4176-8a44-45ad959f6d3a). ## Questions for Claude Stage 4 needs an explicit ownership cutover for existing sampler Sessions; no implicit service→ServiceAccount UID mapping is introduced. --------- Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon-agent
force-pushed
the
codex/agentplane-backend-grpc-tls-listeners
branch
from
November 14, 2026 08:19
ccc6548 to
2b8fe80
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables parallel TLS listeners on Policy Controller and Central Sampler, issues server SVIDs through the existing workload CA mechanism, and adds Service ports and network-policy rules. Both existing plaintext listeners remain available. App and Dispatcher callers still use their existing plaintext targets in this layer.
This PR depends on PR #16332. Its branch includes that code layer so it builds against
devel; the intended review and merge order is #16332, this PR, then the client cutover. After #16332 lands, rebase this branch so the incremental diff contains only this listener layer.Rollout
spiffe://agentplane/policy-controllerandspiffe://agentplane/central-samplerserving certificates and start the separate TLS listeners. Keep callers on the old ports until the next layer is ready.Rollback
Revert this layer to remove the extra TLS listener settings, ports, certificates, and network-policy entries. The existing plaintext listeners and callers remain available. If the client cutover has already rolled out, revert that first.
System tests
The required merge gate for this rollout is:
//agentplane/system_tests/suites/mcp:test_services, scenariotest_policy_binding_auto_approves_the_bound_sandbox.//agentplane/system_tests/suites/mcp:test_services, scenariotest_dispatcher_central_setup_tool_and_retained_answer; alsotest_sampler_roll,test_gateway_crash,test_gateway_budget, andtest_history_outagein the same package.All five system test targets must pass before any layer in this rollout is merged.
Deliberately left out
Client routing remains on plaintext until the following PR. Caller authentication remains ServiceAccount bearer authentication. This does not change the other plaintext dials, Viper loaders, Policy error mapping, pre-cutover tolerances, or Gateway runtime Lease.