mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-10-26 07:23:59 +08:00
Max Thompson
6299696642
Part of #1756. - Adds `kubectl ate admin add-jwt-key`, `activate-jwt-key`, and `remove-jwt-key`, so rotating the actor JWT signing key no longer means editing the pool Secret by hand. A new key is published but signs nothing until activated, which gives relying parties time to fetch it. - Adds `list-jwt-keys`, which prints each key's ID and algorithm and marks the active one, so finding the key to remove doesn't mean decoding a Secret full of private keys. - `ConcretePool` gains `AddAuthority`, `Activate`, `RemoveAuthority`, and `ActiveID`. They refuse a duplicate or empty key ID, activating a key the pool doesn't hold, and removing the key that signs. - Each command writes the Secret back conditional on the resourceVersion it read and retries on a conflict, so a concurrent edit isn't lost. - Generated RS256 keys are now 4096-bit RSA instead of 2048-bit. RS256 stays only for relying parties that require it, such as Azure workload identity federation; ES256 is still the default. - The pool commands share one Kubernetes client helper, and make-jwt-pool's flag variables are renamed so the new commands can reuse them. The commands don't wait for relying parties; the operator decides when to activate and remove. The `--key-id` help describes the PKIX key IDs from #2132, which main doesn't use until that PR merges. Testing: unit tests for the pool methods, and fake-clientset tests for a full rotation, a conflict retry, refused changes, and the listing, plus a test that generated RS256 keys are 4096-bit. Not run against a cluster. - [ ] Tests pass - [ ] Appropriate changes to documentation are included in the PR