zooqueen 46297b6264 egress serves calls, not keys ...

A caller sends a request with no vendor credential. Egress authenticates the
workload behind it, checks that workload may spend on that provider, rewrites
the call onto an address it chose itself, and attaches the credential it holds
in memory. The credential is never returned and never written down.

Three allowlists, none of them reachable from a request field: the provider
table fixes the destination, the operation set fixes which calls exist, and the
grant table fixes who may spend on what. A caller names a provider; it cannot
name a host, so the credential can never sign a request to somewhere else.

Callers present the projected service-account token the kubelet mints for them.
Egress asks the cluster what one means rather than verifying it here, which
keeps revocation instant and leaves no signature checking to get wrong.

Credentials resolve from KMS at boot and refresh on a timer, so a value
rewritten there is in use within the interval with no redeploy. A read names the
full coordinate - path, name and environment - because a bare name resolves to a
different partition and a missing environment to a different environment, and
both return "not found" for a record that exists.

2026-08-14 22:46:55 -07:00

0 lines

0 B

Plaintext

Raw Permalink Blame History

The file is empty.