Max Thompson ccecc788a3 ateapi: require an actor JWT lifetime and align the subject with the SPIFFE ID (#1902) ...

Part of #1756.

- Adds a required `MintActorJWTRequest.expiration_seconds`, validated to
[300, 3600]. Token exchange (#1661) wants longer-lived subject tokens.
- Adds `MintActorJWTResponse.expires_at`, equal to the `exp` claim, so
callers like the egress gateway's cache don't have to decode the token.
- Changes the subject to `actor/<atespace>/<name>`, matching the path of
the actor's SPIFFE ID. The token isn't a JWT-SVID.
- Rewrites the `MintActorJWTResponse` comment to match the settled
contract.

Field 8 skips 2, 3, 4, and 6, which the old ActorIdentity request used.

Testing: validation unit tests for the bounds. The functional test
checks the lifetime, `expires_at`, and `sub`; it needs Docker, so it
hasn't run locally.

- [ ] Tests pass
- [ ] Appropriate changes to documentation are included in the PR (docs
land later in the #1756 series)

2026-09-30 22:52:19 +00:00

..

api/v1alpha1

microvm: drop the kata-config asset (#1704)

2026-09-22 00:18:59 +00:00

client

Drop k8s third_party deps now that HEAD is updated (#1480)

2026-09-04 17:02:12 -07:00

proto

ateapi: require an actor JWT lifetime and align the subject with the SPIFFE ID (#1902)

2026-09-30 22:52:19 +00:00