ActorIdentity: protos, cert issuance, actorIdentity x509 extension - #670
Open
Lior Lieberman (LiorLieberman) wants to merge 4 commits into
Open
Conversation
Lior Lieberman (LiorLieberman)
requested review from
Eitan Yarmush (EItanya),
Taahir Ahmed (ahmedtd) and
Zoe Zhao (zoez7)
July 31, 2026 19:22
Zoe Zhao (zoez7)
previously approved these changes
Jul 31, 2026
| string actor_uid = 4; | ||
| } | ||
|
|
||
| //TODO (lior) check why k8s do ":" and not "/" as a seprator for the Subject format |
Collaborator
There was a problem hiding this comment.
Can we clean up this TODO?
Collaborator
Author
There was a problem hiding this comment.
have any opinion on this?
Collaborator
There was a problem hiding this comment.
I'm not familiar with the history of k8s JWT and why we decided to use ":", I think either is fine here.
app_id, user_id and actor_id had no producer anywhere in the tree and no
mapping to the actor database, which is keyed by (atespace, name). Nothing
could look up the actor a request named. Replace them with the fields the
data model actually uses.
MintCertRequest: atespace = 1, actor_name = 2, csr = 4
MintJWTRequest: audience = 1, atespace = 2, actor_name = 3
Field 3 (MintCert) and field 4 (MintJWT) are deliberately left free as the
slot for a future actor_uid or actor_version, per the TODOs.
The credential identities move with the fields:
JWT sub apps/${app}/users/${user}/actors/${actor}
-> atespaces/${atespace}/actors/${name}
ate.dev {appID, userID, actorID} -> {atespace, actorName}
SPIFFE spiffe://substrate-actor.local/app/../user/../actor/..
-> spiffe://substrate-actor.local/atespace/../actor/..
BREAKING: the request wire format changes. MintCert has no caller in the
tree, so nothing in-repo breaks; external callers must be updated.
No behavior change beyond the rename — the authorization gate this enables
lands separately. Stubs regenerated with the pinned toolchain (protoc-gen-go
v1.36.11-devel, protoc-gen-go-grpc v1.6.1, grpcio-tools 1.81.1), verified to
reproduce the committed baseline byte-for-byte before the proto was edited.
MintCert previously signed any CSR it was handed. The only gate was that a
client certificate had been presented; it never checked who presented it or
whether they had any relationship to the requested actor, contrary to the
contract stated in ateapi.proto. Any workload holding a pod-identity
certificate could mint a credential for an arbitrary actor.
Require instead that the caller is the atelet on the node hosting the actor,
and that the actor is still running:
- the client certificate must carry the atelet SPIFFE identity and a
PodIdentity extension, which pins the caller to a node;
- the actor must be STATUS_RUNNING in the actor database;
- the worker Pod hosting it must be on the caller's node and still assigned
to that actor.
Denials are deliberately indistinguishable so the RPC cannot be used to
discover whether an actor exists or where it is running.
Lior Lieberman (LiorLieberman)
force-pushed
the
actoridentity-mintcert-authz
branch
from
July 31, 2026 21:03
d28973f to
3648b34
Compare
| Subject: fmt.Sprintf("apps/%s/users/%s/actors/%s", req.GetAppId(), req.GetUserId(), req.GetActorId()), | ||
| // TODO: This is currently API but it has to be a globally unique, oidc-compliant and accsible DNS name | ||
| Issuer: "https://api.ate-system.svc", | ||
| Subject: fmt.Sprintf("atespaces/%s/actors/%s", req.GetAtespace(), req.GetActorName()), |
Collaborator
Author
There was a problem hiding this comment.
/atesapces OR at atespace/%s
actors/ OR actor/
Collaborator
|
LGTM. I approve this spelling as a Canadian but we need to make the tests happy: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Also Fixes #575
(1) mintCert + MintJWT proto changes
(2) validate that atelet is the one that calls actorIdentity Service.
(3) verify that this atelet is only requesting a cert for an actor on its node.
(4) verify that the actor is still running
(5) create another substatex509 extension for actor identities
JWTs needs more love, lots as TODO there