mdella/monky-deployd
1
0
Fork 0
mirror of https://scm.tikali.ai/tikali/applications/monky/monky-deployd.git synced 2026-09-18 04:36:15 +00:00
Code Issues Packages Projects Releases 1 Wiki Activity

Merge branch 'docs/attrs-now-added-by-broker' into 'main'

Browse Source 
docs: the broker adds the agent attrs at register since 2026-09-07 — !9's 'not implemented yet' was stale on arrival

See merge request tikali/applications/monky/monky-deployd!10
This commit is contained in:
Marcos Della
2026-09-07 12:07:48 -07:00
parent 6e8b2bf41d d0153dd71c
commit 47c3840c95
2 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+3 -3
View File
@@ -98,9 +98,9 @@ monky-deployd version
## Security model ## Security model
- **Identity = the box's ziti host identity.** Only identities with `#monky-deploy-agent` can dial - **Identity = the box's ziti host identity.** Only identities with `#monky-deploy-agent` can dial
tenancy's agent entrypoint; `#openbao-client` reaches OpenBao — the broker does not add either tenancy's agent entrypoint; `#openbao-client` reaches OpenBao — tenancy sends both to the broker
attr yet (ADR-0028 addendum; see PROTOCOL.md §Where and how), so today an operator adds them on as `host_extra_attrs` at register (monky-tenancy !29 / monky-ziti `ac258352`, 2026-09-07), so a
the controller after enrolment. The agent reads the identity backend registered since then dials without hand-added attrs (see PROTOCOL.md §Where and how). The agent reads the identity
through an ACL (`setfacl -m u:monky-deployd:r`), never owns it. through an ACL (`setfacl -m u:monky-deployd:r`), never owns it.
- **The bearer to tenancy is the agent's own OpenBao token**, minted by OpenBao from a - **The bearer to tenancy is the agent's own OpenBao token**, minted by OpenBao from a
tenancy-signed ES256 deploy grant (`aud openbao-see-env`, `kind deploy-grant`, 1 h; its `jti` tenancy-signed ES256 deploy grant (`aud openbao-see-env`, `kind deploy-grant`, 1 h; its `jti`
docs/PROTOCOL.md
+4 -5
View File
@@ -15,11 +15,10 @@ The agent side of the backend lifecycle agent protocol — [MONKY-ADR-0028](http
`state/overlay/configs.json` — the authority for the port); the sidecar's `host.v1` forwards to `state/overlay/configs.json` — the authority for the port); the sidecar's `host.v1` forwards to
`127.0.0.1:8081` inside the pod. `tenancy.port` in the config, `install.sh` and the ansible role all `127.0.0.1:8081` inside the pod. `tenancy.port` in the config, `install.sh` and the ansible role all
default to 443 (0.1.5). Only host identities carrying `#monky-deploy-agent` may dial default to 443 (0.1.5). Only host identities carrying `#monky-deploy-agent` may dial
(`monky.tenancy.deploy.dial`, openziti). Adding that attr (and `#openbao-client`) to (`monky.tenancy.deploy.dial`, openziti). Tenancy sends that attr and `#openbao-client` to the
`monky-host.<env>` at kit reveal is the ADR-0028 addendum and is **not implemented in monky-ziti broker as `host_extra_attrs` when it registers an agent-backed backend (monky-tenancy !29,
yet** (its host template `app/fabric.py` `host_identity_attrs` does not carry it; openziti monky-ziti `ac258352` — both 2026-09-07), so `monky-host.<env>` carries them from creation;
`docs/services.md` §Platform services records when it does) — until then an operator adds both identities created before that (env-qa-02's) had them added on the controller by hand.
attrs on the controller by hand after enrolment.
- **Transport:** plain HTTP inside the mesh (`transport: sdk` dials by service name; - **Transport:** plain HTTP inside the mesh (`transport: sdk` dials by service name;
`proxy` → `127.0.0.1:18443`). OpenBao is the existing `openbao` ziti service (`#openbao-client`), `proxy` → `127.0.0.1:18443`). OpenBao is the existing `openbao` ziti service (`#openbao-client`),
dialled as `https://bao.cbs.tikali.net:8200` (an intercept name), TLS validated against the dialled as `https://bao.cbs.tikali.net:8200` (an intercept name), TLS validated against the