feat(operator): nested SPIRE topology + edge SPIFFE IDs (proposal 012 PR-2) - #86
Merged
Conversation
Second PR of proposal 012 — extends the operator-side SPIFFE
provisioning (011 PR-2) to edge deployments.
Inert by design: no behaviour change until an operator sets
deployMode=edge + spec.spiffe.
CRD changes (agentcollective_types.go + hand-updated CRD bases):
* SpiffeSpec gains EdgeTopology (nested | federated | ed25519,
default nested) + EdgeSiteID.
* AgentCollectiveStatus gains EdgeSiteID — echoes the site
qualifier baked into SpiffeID.
Reconciler (collective/spiffe.go):
* New computeSpiffeID() — when the owning AgentCorpus has
deployMode=edge AND spiffe.edgeTopology=nested, the SPIFFE ID
is site-qualified:
spiffe://<trust-domain>/edge/<site-id>/role/<collective>
Federated / ed25519 topologies + every non-edge deploy mode
keep the flat spiffe://<trust-domain>/role/<collective> form.
* nested topology without an edgeSiteID reports a config error
via SpiffeResult.Err -> status.spiffeError; never hard-fails
reconciliation.
* CollectiveReconciler.patchSpiffeStatus also patches EdgeSiteID.
Deploy manifests (deploy/edge-spire/):
* nested-spire-server.values.yaml — Helm values overlay for the
upstream spiffe/spire chart configured for nested topology
(edge SPIRE downstream of an rhoai parent). ACC does not
vendor SPIRE — operators helm-install it.
* edge-bundle-fetcher.yaml — PVC + CronJob caching the parent
SPIRE trust bundle every 6h for offline survival.
* README.md — install runbook + the edgeSiteID-uniqueness
requirement + the no-RWX fallback.
Test coverage: 5 unit tests in spiffe_edge_test.go covering the
site-qualified ID, the missing-edgeSiteID error path, federated
plain ID, non-edge topology-ignored, and ed25519 topology.
Validated on lighthouse: go build ./... clean, full operator
suite green.
Stacked on spiffe/agent-sidecar (011 PR-3, PR #85), which is
itself stacked on 011 PR-2 (#84).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
flg77
force-pushed
the
spiffe-edge/nested-topology
branch
from
May 15, 2026 15:53
118b300 to
351d491
Compare
This was referenced May 15, 2026
flg77
added a commit
that referenced
this pull request
Jun 15, 2026
fix(acc-deploy/pkg): apply degrades gracefully when packages root isn't host-writable (#85)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Second PR of proposal 012 — extends operator-side SPIFFE provisioning (011 PR-2) to edge deployments with site-qualified SPIFFE IDs.
Stacked 3-deep: base is
spiffe/agent-sidecar(#85), itself onspiffe/operator-controller(#84), itself onmain. Merge #84 → #85 → this, retargeting each tomainas the chain collapses.Inert by design — no behaviour change until an operator sets
deployMode: edge+spec.spiffe.What's new
CRD (
agentcollective_types.go+ hand-updated bases):SpiffeSpecgainsedgeTopology(nested | federated | ed25519, defaultnested) +edgeSiteID.AgentCollectiveStatusgainsedgeSiteID.Reconciler (
collective/spiffe.go):computeSpiffeID— when the owningAgentCorpushasdeployMode: edgeandspiffe.edgeTopology: nested, the SPIFFE ID is site-qualified:spiffe://<trust-domain>/edge/<site-id>/role/<collective>. Federated/ed25519 topologies + every non-edge deploy mode keep the flatspiffe://<trust-domain>/role/<collective>form.nestedwithout anedgeSiteID→ config error viastatus.spiffeError, never a hard reconcile failure.patchSpiffeStatusalso patchesedgeSiteID.Deploy manifests (
deploy/edge-spire/):nested-spire-server.values.yaml— Helm values overlay for the upstreamspiffe/spirechart in nested mode.edge-bundle-fetcher.yaml— PVC + CronJob caching the parent trust bundle (offline survival).README.md— install runbook + theedgeSiteID-uniqueness requirement + a no-RWX fallback.Test plan
go build ./...clean — validated on lighthousespiffe_edge_test.go— site-qualified ID, missing-edgeSiteIDerror, federated plain ID, non-edge topology ignored, ed25519 topology plain IDProposal 012 reference
012 - SPIRE for ACC edge deployments.md. PR-1 #83 merged. PR-3 (federation + configurable offline action) next.🤖 Generated with Claude Code