Repository navigation
docs: ADR 0008 — agent identity in a namespaced Secret, the one write grant - #17
Merged
Merged
Conversation
… grant Identity is not data: it cannot be re-derived from the cluster, and with emptyDir (ADR 0007) a reschedule after the enrollment token's TTL left the agent silently local-only until an operator intervened. - ADR 0008: key and certificate live in one pre-created, named Secret; Helm owns the object's existence, the agent owns only its content via get/update scoped by resourceNames in a namespaced Role — no create (cannot be name-scoped), no list/watch/delete. persistence.enabled: true keeps identity on the PVC and emits no write grant at all. DaemonSet profiles hold no backend identity — projected SA tokens toward the controller, promised, not accidental. Full lifecycle section including helm upgrade three-way merge and the ArgoCD ignoreDifferences note. - security.md §4: the categorical no-write-verbs claim is replaced by the disclosed single exception, with its own RBAC table row; the storage section moves credentials from the volume to the Secret with honest etcd/backup consequences; the emptyDir degradation and key-loss recovery notes updated accordingly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Docs-only slice fixing the identity-durability gap the user spotted after ADR 0007: data loss is bounded by snapshot delivery, but identity loss was not — a reschedule after the enrollment token's TTL meant silent local-only mode until an operator intervened.
The decision (ADR 0008)
get+updatein a namespaced Role scoped byresourceNames. Nocreate(cannot be name-scoped — pre-creation is what keeps the grant airtight), nolist/watch/delete, no ClusterRole. The only write verb in the product.persistence.enabled: truekeeps identity on the PVC and the chart emits no Secret grant at all.datatemplate → atomic single-updateafter enrollment → survives restart/reschedule/upgrade (Helm three-way merge; ArgoCDignoreDifferencesnote) → dies withhelm uninstalldeliberately.Honest consequences (in the ADR and security.md)
The categorical "no write verbs anywhere" becomes "one disclosed, name-scoped exception"; the key gains one copy location (etcd + Secret-including backups), whose theft buys only telemetry poisoning of that one cluster — the protocol is one-way, monetary-free, fingerprint-checked, and recovery is revoke + re-enroll with continuous history.
Amends ADR 0003/0005 on storage location; their core decisions stand. No code — enrollment does not exist yet; these documents lead it per the ADR-first rule.
🤖 Generated with Claude Code