Repository navigation
agentplane: switch backend clients to verified TLS - #16334
Open
agentydragon-agent wants to merge 3 commits into
Open
agentydragon-agent wants to merge 3 commits into
agentydragon-agent wants to merge 3 commits into
Conversation
Contributor
Visual review for
|
This was referenced Nov 14, 2026
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…6352) Record the current first-party credential, audience, admission, transport and delegation paths, and reconcile the gRPC/workload authentication guidance with the operator’s 2026-11-14 service-SVID decision (#16342). The inventory separates the future Sessions → Runtime proxy hop from proxy → Runtime, and keeps each caller role independent of today’s combined Gateway binary. It records outside-Agentplane Haku routes and the remaining TLS gaps. This is stage 1. It deliberately leaves out issuance, receiver wiring, caller settings and bearer removal; those are separately rolled PRs. #16333/#16334 own the in-flight Policy/sampler TLS changes. The service principal APIs are specified here and implemented separately in #16350. Validation: pre-commit and commit hooks passed. This documentation-only change has no deployment or system-test behavior to exercise; shared auth baseline tests passed in the decision PR. Rollback: revert this documentation PR; no manifests, data or traffic change. ## Questions for Claude Before the later sampler→LLM caller cutover, verify staging Sessions retain execution Identity name and UID for typed delegation. The inventory records that gate; it does not enable the cutover. --------- Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…nt token (#16342) The operator selected service SVIDs over mTLS for every first-party service call on 2026-11-14 (“One auth mode can fire off”). Move PRIVILEGED_BACKEND_AUTH_DESIGN into Unblocked, replace the retained backend TokenReview decision, and make the exit explicit: no Agentplane receiver admits a Kubernetes bearer, including the app’s special agent token. Record the separate app-token removal sequence and freeze Authentik live-test credential provisioning until agents/scripts need staging smoke tests. Certificate issuance, receiver admission, caller cutover and bearer/RBAC removal retain their image-pin and settings rollout gates. #16333 and #16334 remain separate in-flight transport work. Validation: changed-file pre-commit passed after formatting; git diff --check passed. An all-files pre-commit attempt lost the executor connection during markdownlint and did not complete. This is planning-only; no runtime or system-test behavior changes. Rollback: revert this documentation commit; deployed services, settings and credentials are unaffected. Deliberately leaves out implementation, deployment, caller switches, all bearer/code/RBAC removals, and the parked token provisioning. Follow-up PRs stop at stage 3 plus app-agent-token step (a), pending operator image-pin confirmation. ## Questions for Claude None; this records the operator’s decisions and rollout constraints. Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Switches App → Policy Service and Dispatcher → Central Sampler to the verified TLS Service ports. Both clients keep their current ServiceAccount bearer tokens. Updates the gRPC transport guidance and system overview edges.
This PR depends on #16332 and #16333. Its branch contains those prerequisite commits so it builds against
devel; merge in order #16332, #16333, then this PR. After the lower layers land, rebase this branch so its incremental diff contains only the client cutover and documentation.Rollout
Rollback
Revert this layer to restore the old plaintext targets and remove client TLS settings. The dual listeners remain available, so both routes continue to work. Caller authentication does not change.
System tests
The required merge gate for this rollout is:
//agentplane/system_tests/suites/mcp:test_services, scenariotest_policy_binding_auto_approves_the_bound_sandbox.//agentplane/system_tests/suites/mcp:test_services, scenariotest_dispatcher_central_setup_tool_and_retained_answer; alsotest_sampler_roll,test_gateway_crash,test_gateway_budget, andtest_history_outagein the same package.All five system test targets must pass before any layer in this rollout is merged.
Deliberately left out
No mTLS caller authentication, other plaintext dial changes, Viper loader changes, Policy error mapping, pre-cutover tolerances, or Gateway runtime Lease changes.