Repository navigation
Conversation
A device that holds only a key and a token, with no Connector or binding registered for it, cannot join a VPC network today: the gateway admits only the grants in its configuration. Add an optional token_admission section to the IP configuration. When it is present, the gateway answers CONNECT-IP requests that match no grant through Connect's admission callback. The request must carry "Proxy-Authorization: Bearer <token>" for the configured network, and the token must pass the issuer checks. The device then gets the address Connect derives for that project, network and pair of keys, the configured routes, and no peer routes. The grant lasts for that session, and a token's ID is spent only when its session starts. The session lasts until its connection closes: the token's expiry does not end it. Routes must be 1 to 32 IPv6 prefixes that do not overlap and do not cover fd00::/8, where device addresses are derived. A device whose address falls inside a route is refused. An empty issuer list is valid and refuses every token, while static grants keep working. Each admission is logged when its session starts, with the issuer, subject, token ID and expiry, never the token. Without the section, the gateway behaves as before. Raise CONNECT_REV to a Connect revision with the admission callback.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A device that holds only a key and a token, with nothing registered for it, cannot join a VPC network today because the gateway admits only configured grants.
With the new optional token admission configuration, a request that matches no grant is admitted when its bearer token passes the issuer checks. The device gets the address Connect derives for it and only the configured routes, for as long as its connection stays open, even past the token's expiry.
Without that configuration the gateway behaves as before.
Depends on
Stacked on the token claims pull request. It also needs the Connect preview 28 pull request and a Connect revision with the admission callback. Its end-to-end check uses a device built with Connect's bearer token pull request.
Test plan
Related to datum-cloud/enhancements#883, datum-cloud/enhancements#916 and milo-os/milo#930