Repository navigation
agentplane: decide service SVID authentication and remove the app agent token - #16342
Merged
agentydragon merged 1 commit intoNov 14, 2026
Conversation
agentydragon-agent
force-pushed
the
agent/service-svid-decision
branch
from
November 14, 2026 06:19
107a2f2 to
9034918
Compare
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
The Agentplane organization plan still said no service authentication mechanism was selected. The operator chose one on 2026-11-14: "One auth mode can fire off", `PRIVILEGED_BACKEND_AUTH_DESIGN` option 2. Its decision record is in #16342. This brings the plan in line. ## What changes - **`privileged-auth`** now reads "Replace backend bearers with service SVIDs without moving the auth owners". It is PLANNED, where it was DEFERRED DESIGN. - Every first-party service call authenticates its caller with a service SVID over mTLS. - Bearer admission, Agentplane's TokenReview, projected token audiences and the `tokenreviews` RBAC go. - The app's `agentplane-agent` bearer goes separately. - The migration removes code paths inside files and moves none: `net/peertls` and `identity/auth` stay the owners. Its stages belong to the DAG node, with the receiver step in #16350. - No reorg move waits on it. - **Stage 6** is now "Service authentication migration and deferred protobuf contracts". Protobuf namespaces stay deferred. - **Runtime proxy grant.** The proxy's mutating methods go to the Sessions binary's **service SVID**, in both the `runner-gateway-connections-proxy` track and the "Runtime calls" cut-line card. Before, it said "workload identity". - **`net/peertls` package gate.** The SVID migration now extends the package in place. - **Evidence and README.** `evidence.json` records the operator's words, and the report README's stage and status text matches. ## Deliberately left out - **No file dispositions change.** TokenReview code sits inside files that otherwise stay; the migration's own PRs remove it. - **No ledger re-pin.** No Agentplane source changed since `02dc3c7a2e`. ## Checks - Structural check against the `02dc3c7a2e` inventory: PASS (42 tracks, 1,270 files, 222 packages). - `prettier@3.9.10 --check`: clean. - Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors. - No source behaviour tests run; this is a planning-only change. --- _Generated by [Claude Code](https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm)_ Co-authored-by: Claude <noreply@anthropic.com>
agentydragon-agent
force-pushed
the
agent/service-svid-decision
branch
from
November 14, 2026 06:46
9034918 to
86373d6
Compare
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…6352) Record the current first-party credential, audience, admission, transport and delegation paths, and reconcile the gRPC/workload authentication guidance with the operator’s 2026-11-14 service-SVID decision (#16342). The inventory separates the future Sessions → Runtime proxy hop from proxy → Runtime, and keeps each caller role independent of today’s combined Gateway binary. It records outside-Agentplane Haku routes and the remaining TLS gaps. This is stage 1. It deliberately leaves out issuance, receiver wiring, caller settings and bearer removal; those are separately rolled PRs. #16333/#16334 own the in-flight Policy/sampler TLS changes. The service principal APIs are specified here and implemented separately in #16350. Validation: pre-commit and commit hooks passed. This documentation-only change has no deployment or system-test behavior to exercise; shared auth baseline tests passed in the decision PR. Rollback: revert this documentation PR; no manifests, data or traffic change. ## Questions for Claude Before the later sampler→LLM caller cutover, verify staging Sessions retain execution Identity name and UID for typed delegation. The inventory records that gate; it does not enable the cutover. --------- Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…16350) Add an explicit service-certificate principal and exact, method-scoped service allowlists. A service actor may assert a live Identity only with a separately granted typed delegation envelope; it never becomes an account, Pod or effective Identity grant. Certificate failures and mixed service/bearer credentials are terminal. Listeners opt into verifying service client certificates independently of existing workload admission. The forward-proxy workload boundary stays unchanged. Server-auth-only listeners gain an optional client trust-bundle setting for subsequent receiver PRs. This is the shared stage-3 prerequisite for the 2026-11-14 service SVID decision (#16342). It deliberately leaves out production receiver wiring, manifest settings, caller cutovers and bearer/RBAC removal: receivers and their images must land before callers rely on these APIs. Validation: focused pre-commit and commit hooks passed. `bbr test //agentplane/identity/auth:auth_test //agentplane/net/peertls:peertls_test //agentplane/identity/auth/listener:listener_test` passed ([invocation](https://app.buildbuddy.io/invocation/1aa21576-4eea-47d1-a2a9-551f95afa93e)). Tests exercise actual TLS, exact caller denial, issuer/EKU/expiry denial, typed delegation, stale effective Identity, absent actor proof and refusal of bearer fallback; existing rotation checks remain. Isolated prerequisite verification also passed: the three test targets plus `//agentplane/net/peertls:config` ([invocation](https://app.buildbuddy.io/invocation/11e9543e-15ce-416c-b883-20354b55f53e)). CI validates the rebased ready PR. Rollback: revert this PR before dependent receiver PRs; no production settings or traffic change. Check current workload and bearer listeners continue serving after image rollout. No cluster system behavior is changed by these opt-in APIs; receiver PRs carry deployment system-test coverage. ## Questions for Claude None. Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon
pushed a commit
that referenced
this pull request
Nov 14, 2026
…#16359) Issue Agentplane service certificates with client and server EKUs from the workload CA and mount them read-only with the trust bundle. Reuse the Sandbox Controller cert-manager/client mount pattern from #16324. Preserve current serving names/paths and the existing Gateway Runtime-control certificate; add separate Sessions, Runtime-proxy and Environments role credentials so the planned binary split moves identities rather than dividing one shared grant. Stage 2 of #16342. Deliberately leaves out new service settings, receiver allowlists, caller switches and bearer/RBAC removal. Pinned images reject unknown settings; no new settings keys are rendered here. Mounting certificates does not activate new traffic. The system overview distinguishes these mounts from the planned binary split. Validation: pre-commit and commit hooks passed. The red CI run was a stale test expectation: the Gateway serving workload certificate now intentionally has both `client auth` and `server auth` EKUs after becoming a `service_certificate`; no mount or manifest behavior failed. The repaired test checks those EKUs, all three role-specific client SVID URIs/usages, and each mounted Secret. `bbr test //cluster/cdk8s/agentplane:test_runner_gateway_workload //cluster/cdk8s/agentplane:test_workload_trust //cluster/cdk8s/agentplane:test_sandbox_controller` passed ([invocation](https://app.buildbuddy.io/invocation/5eb955ee-f0c2-4178-a4e1-cdc19c0b195c)). The named changed Python libraries passed `bbr build //cluster/cdk8s/agentplane:actions //cluster/cdk8s/agentplane:app //cluster/cdk8s/agentplane:central_sampler_workload //cluster/cdk8s/agentplane:egress //cluster/cdk8s/agentplane:history_service //cluster/cdk8s/agentplane:llm_ingress //cluster/cdk8s/agentplane:mcp_edge //cluster/cdk8s/agentplane:notifications //cluster/cdk8s/agentplane:policy_controller //cluster/cdk8s/agentplane:runner_gateway_workload //cluster/cdk8s/agentplane:workload_tls //agentplane/net/peertls:config` ([invocation](https://app.buildbuddy.io/invocation/0c94f9a2-6f82-48d9-94c1-86d31e47f622)). The earlier workload-trust, sandbox-controller, and manifest checks also passed ([invocation](https://app.buildbuddy.io/invocation/4c22cab8-f8c4-4e58-a67e-469e2de4927a)); the existing manifest test’s generated patch artifact supplied the regenerated YAML. Flux, cert-manager and trust-manager objects have no deployment system test; staging is their first cluster. No service has begun using the new credentials. Rollback: revert this PR before caller cutover. Confirm Flux becomes Ready, existing serving certificate Secrets remain mounted and current TLS clients still connect. After callers rely on these mounts, restore compatible caller settings/images before removing their Secrets/mounts; keep the workload CA and existing Runtime-control certificate intact. ## Questions for Claude None. --------- Co-authored-by: agentydragon-agent <260791330+agentydragon-agent@users.noreply.github.com>
agentydragon
added a commit
that referenced
this pull request
Nov 14, 2026
This is the single open batch PR for the Agentplane organization plan. Further plan updates go here as commits until it merges, instead of one PR each. ## Commit 1: re-pin to devel `1f3e26cc58` and place `environmentaccess` Eight Agentplane commits landed after `02dc3c7a2e`: #16345, #16346, #16340, #16350, #16352, #16342, #16347 and #16359. They added five Go files and removed or moved none. None of them finishes a plan track. - **New package `runner_gateway/environmentaccess`.** It holds the environment rules from #16346. - It moves with EnvironmentService to `environments/access` (package `access`). - It stays outside `internal/` because the open slice #16351 makes Session admission enforce `bind_session` with it, so both binaries import it. - It is a rule parser over the shared policy reader, like `inboxaccess` and egress `policy`. - **New files in existing packages.** They take their package siblings' dispositions: - `identity/auth/service{,_test}.go` is retained. - `environments/environment_grants_test.go` moves with EnvironmentService. - **Landed steps recorded:** - `transition-tolerance-removal`: #16340 dropped the pre-Identity Dispatcher rows, and #16341 removes the branches. History's empty Sandbox UID is no longer listed as "not a leftover": #16356 refuses writers without one, ahead of the #16336 drop, which is on hold. - `gateway-connection-lease-removal`: #16345 has merged and #16361 is open. - **Cut line, explicit resume.** Since #16346 an Identity with a `resume` grant may resume, and every explicit resume reserves the Dispatcher-database wake budget. After the split, EnvironmentService has no database, so this crossing needs either its own bound or a call back to Sessions. It is queued as an operator question, after the identity fence. - **Counts and freshness.** The ledger, counts, freshness evidence and listing counts are updated: 1,275 files in 223 packages. ## Checks - Structural check against the `1f3e26cc58` inventory: PASS (42 tracks, 1,275 files, 223 packages). - `prettier@3.9.10 --check`: clean. - Local Playwright: the home page and the report render at desktop and mobile, in light and dark, with no horizontal overflow and no console errors. The binaries section still shows all seven cut-line cards. - No source behaviour tests run; this is a planning-only change. --- _Generated by [Claude Code](https://claude.ai/code/session_01AYUnw7BD5YA1NAuqjeKKSm)_ Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The operator selected service SVIDs over mTLS for every first-party service call on 2026-11-14 (“One auth mode can fire off”). Move PRIVILEGED_BACKEND_AUTH_DESIGN into Unblocked, replace the retained backend TokenReview decision, and make the exit explicit: no Agentplane receiver admits a Kubernetes bearer, including the app’s special agent token.
Record the separate app-token removal sequence and freeze Authentik live-test credential provisioning until agents/scripts need staging smoke tests. Certificate issuance, receiver admission, caller cutover and bearer/RBAC removal retain their image-pin and settings rollout gates. #16333 and #16334 remain separate in-flight transport work.
Validation: changed-file pre-commit passed after formatting; git diff --check passed. An all-files pre-commit attempt lost the executor connection during markdownlint and did not complete. This is planning-only; no runtime or system-test behavior changes.
Rollback: revert this documentation commit; deployed services, settings and credentials are unaffected.
Deliberately leaves out implementation, deployment, caller switches, all bearer/code/RBAC removals, and the parked token provisioning. Follow-up PRs stop at stage 3 plus app-agent-token step (a), pending operator image-pin confirmation.
Questions for Claude
None; this records the operator’s decisions and rollout constraints.