From d0153dd71c4dffe182611b7df02f1d74ca7aa31a Mon Sep 17 00:00:00 2001 From: Claude-Docs-Manager Date: Mon, 7 Sep 2026 09:01:28 -0700 Subject: [PATCH] =?UTF-8?q?docs:=20the=20broker=20DOES=20add=20the=20agent?= =?UTF-8?q?=20attrs=20at=20register=20since=202026-09-07=20=E2=80=94=20!9'?= =?UTF-8?q?s=20"not=20implemented=20yet"=20was=20stale=20on=20arrival?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit !9 (d34189c6) rewrote PROTOCOL.md §Where and how and README §Security model to say monky-ziti does not add #monky-deploy-agent / #openbao-client yet and an operator adds them by hand. That was verified against monky-ziti at the sweep HEAD b44c50a4 (2026-09-05), not its live HEAD: monky-ziti ac258352 (2026-09-07 06:12Z, "feat(environments): host_extra_attrs — host-template-only attrs for the agent's dial right", merged a82359dd) and monky-tenancy !29 9b84f9ee (06:23Z, app/jobs_backends.py sends host_extra_attrs for non-k8s backends) landed hours before !9 was opened. Both sentences now state what happens: tenancy sends the attrs at register, the broker puts them on the host identity, and only pre-!29 identities (env-qa-02's) were hand-added. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01AW3QqEpwLV69KHn24Re45Q --- README.md | 6 +++--- docs/PROTOCOL.md | 9 ++++----- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 98170e0..ffc0756 100644 --- a/README.md +++ b/README.md @@ -98,9 +98,9 @@ monky-deployd version ## Security model - **Identity = the box's ziti host identity.** Only identities with `#monky-deploy-agent` can dial - tenancy's agent entrypoint; `#openbao-client` reaches OpenBao — the broker does not add either - attr yet (ADR-0028 addendum; see PROTOCOL.md §Where and how), so today an operator adds them on - the controller after enrolment. The agent reads the identity + tenancy's agent entrypoint; `#openbao-client` reaches OpenBao — tenancy sends both to the broker + as `host_extra_attrs` at register (monky-tenancy !29 / monky-ziti `ac258352`, 2026-09-07), so a + backend registered since then dials without hand-added attrs (see PROTOCOL.md §Where and how). The agent reads the identity through an ACL (`setfacl -m u:monky-deployd:r`), never owns it. - **The bearer to tenancy is the agent's own OpenBao token**, minted by OpenBao from a tenancy-signed ES256 deploy grant (`aud openbao-see-env`, `kind deploy-grant`, 1 h; its `jti` diff --git a/docs/PROTOCOL.md b/docs/PROTOCOL.md index 7c372a4..35e89f0 100644 --- a/docs/PROTOCOL.md +++ b/docs/PROTOCOL.md @@ -15,11 +15,10 @@ The agent side of the backend lifecycle agent protocol — [MONKY-ADR-0028](http `state/overlay/configs.json` — the authority for the port); the sidecar's `host.v1` forwards to `127.0.0.1:8081` inside the pod. `tenancy.port` in the config, `install.sh` and the ansible role all default to 443 (0.1.5). Only host identities carrying `#monky-deploy-agent` may dial - (`monky.tenancy.deploy.dial`, openziti). Adding that attr (and `#openbao-client`) to - `monky-host.` at kit reveal is the ADR-0028 addendum and is **not implemented in monky-ziti - yet** (its host template `app/fabric.py` `host_identity_attrs` does not carry it; openziti - `docs/services.md` §Platform services records when it does) — until then an operator adds both - attrs on the controller by hand after enrolment. + (`monky.tenancy.deploy.dial`, openziti). Tenancy sends that attr and `#openbao-client` to the + broker as `host_extra_attrs` when it registers an agent-backed backend (monky-tenancy !29, + monky-ziti `ac258352` — both 2026-09-07), so `monky-host.` carries them from creation; + identities created before that (env-qa-02's) had them added on the controller by hand. - **Transport:** plain HTTP inside the mesh (`transport: sdk` dials by service name; `proxy` → `127.0.0.1:18443`). OpenBao is the existing `openbao` ziti service (`#openbao-client`), dialled as `https://bao.cbs.tikali.net:8200` (an intercept name), TLS validated against the