Repository navigation
docs: ADR 0010 — node → controller inventory channel - #20
Merged
Merged
Conversation
… auth, local JWKS) Records the decision for delivering the node role's Go-binary findings to the controller: node-initiated HTTP push of already-filtered facts, authenticated with a projected controller-audience ServiceAccount token and validated locally against the cluster JWKS (no TokenReview, so no new RBAC verb). The node keeps zero RBAC and cannot reach the API server (wrong audience and no grant); nothing is persisted on the node. Plain HTTP is chosen with the confidentiality tradeoff stated and the blast radius bounded (ADR 0008). The controller joins facts against PodWatcher into a per-(namespace, workload, container) inventory in memory, preserving the loss-harmless property (ADR 0003). Realizes the promise in ADR 0008 §4 and extends ADR 0009's log-only scope. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Slice 1 of delivering the node role's Go-binary inventory to the controller and turning it into a payload. This PR is docs only: ADR 0010, the architecture checkpoint for the channel.
The decision
TokenReview. The controller verifies the token itself against the cluster JWKS — nocreate tokenreviews, so no new RBAC verb.Follow-up slices (plan approved)
internal/nodeauthtoken-verify library + unit tests3a. node client + controller receiver + node manifest token volume +
security.md3b. join +
go_inventorypayload + golden + coverage counterssecurity.mdis updated in the slices that land the behavior (3a/3b), per the same-PR rule.🤖 Generated with Claude Code