Conversation
Extends proposal 011 PR-1's SpiffeConfig with the 11 edge-specific fields from proposal 012 §5 step 1 + the three cross-field validators that fall out of operator's §8 answers (Q1-Q6, resolved 2026-05-15). Inert by design: every deploy_mode still defaults to signing_mode: ed25519 in v0.4.x, so the new fields are read but not consumed. 012 PR-2..PR-4 wire the actual SPIRE manifests + agent-side bundle cache + federation handshakes. New SpiffeConfig fields: edge_topology nested | federated | ed25519 edge_site_id operator-supplied (Q5) parent_spire_url required for nested federation_peers required for federated offline_bundle_cache_path default /run/spire/cache/bundle.pem offline_max_age_h default 72.0 bundle_refresh_h default 6.0 (Q1) offline_action rotate | degrade | shutdown (Q2) parent_unreachable_action block | degrade (Q4) nats_mtls_cert_path Ed25519 fallback path (Q6) nats_mtls_key_path Ed25519 fallback path (Q6) New ACCConfig validator _validate_edge_spiffe_fields enforces topology-specific requirements only when: - deploy_mode == "edge" AND - spiffe.enabled == True AND - signing_mode == "spiffe" (operator actually consuming SPIFFE) Three rules: 1. nested needs parent_spire_url + edge_site_id 2. federated needs >= 1 federation_peers entry 3. offline_action=rotate requires edge_topology=nested Non-edge deployments + edge with signing_mode=ed25519 pass through the validator without raising — edge fields stay advisory. Nine new env-var overrides for the scalar edge fields. federation_peers (list type) stays YAML-only since _apply_env writes scalar strings. Test coverage: 19 new tests in tests/test_config.py::TestSpiffeEdgeDefaults covering defaults, every cross-field validator path (nested missing fields, federated missing peers, rotate requires nested), non-edge topology skip for all three deploy_modes, all happy paths, env-var roundtrip on every scalar override, and invalid-value rejection for the two new Literal types. Combined with 011 PR-1's 15 tests: 76/76 green on tests/test_config.py. Stacked on top of spiffe/config-surface (011 PR-1, PR #81). Total: +447 / -0 LOC across 3 files. Well under the 800-LOC budget. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
4 tasks
flg77
added a commit
that referenced
this pull request
Jun 15, 2026
…(0.2.0) (#82) #74 (webgui/tui spec) and #76 (SharedModel status) updated config/crd/bases/ but did not mirror into bundle/manifests/, so the OLM bundle's agentcorpora CRD lacked spec.webgui/spec.tui + status.sharedModel and agentcollectives lacked the assistant role enum. OLM installs the BUNDLE CRD, so without this the API server would reject spec.webgui/spec.tui even on 0.2.0. Mirror config/crd/bases/*.yaml -> bundle/manifests/ (the hand-maintained-bundle convention; `make bundle` is unscaffolded — WS-A gap). Caught during the live 0.2.0 build on acc1. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
flg77
pushed a commit
that referenced
this pull request
Jun 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Extends proposal 011 PR-1's
SpiffeConfigwith the 11 edge-specific fields and three cross-field validators required by proposal 012. Stacked on top of #81 (011 PR-1) — that PR must merge first, then this rebases ontomain.Inert by design: every
deploy_modestill defaults tosigning_mode: ed25519in v0.4.x; the new fields are read but not consumed. 012 PR-2..PR-4 wire the SPIRE manifests, bundle cache, federation handshakes, and edge-edge integration tests.What's new
11 new
SpiffeConfigfields (Q1–Q6 from proposal 012 §8):edge_topologynested | federated | ed25519nestededge_site_id""parent_spire_url""federation_peers[]offline_bundle_cache_path/run/spire/cache/bundle.pemoffline_max_age_h72.0bundle_refresh_h6.0offline_actionrotate | degrade | shutdownrotateparent_unreachable_actionblock | degradedegradenats_mtls_cert_path""nats_mtls_key_path""New
ACCConfig._validate_edge_spiffe_fieldsmodel validator — enforces topology-specific requirements only whendeploy_mode: edgeANDspiffe.enabled: TrueANDsigning_mode: spiffe:nestedrequiresparent_spire_url+edge_site_idfederatedrequires ≥ 1federation_peersentryoffline_action: rotaterequiresedge_topology: nested(rotation needs a local SPIRE server)Non-edge deployments + edge with
signing_mode: ed25519skip the validator entirely — edge fields stay advisory.Nine new env-var overrides for the scalar edge fields.
federation_peers(list type) stays YAML-only since_apply_envwrites scalar strings.Test plan
tests/test_config.py::TestSpiffeEdgeDefaultsnestedmissing fields,federatedmissing peers,rotaterequiresnested)nested,federated,degrade-with-federated)deploy_modeskip forstandalone+rhoaiedge_topology+offline_actionLiteralstests/test_config.pyProposal 012 reference
Vault:
012 - SPIRE for ACC edge deployments.md. Status:Proposed, Q1–Q6 resolved 2026-05-15 per inline answers folded into §11 amendments.PR-2 next: edge-side SPIRE manifests + operator reconciler extension.
🤖 Generated with Claude Code