Smoosh CredentialBroker and WorkerCapacity into AteomSupport - #1501
Open
Taahir Ahmed (ahmedtd) wants to merge 2 commits into
Open
Smoosh CredentialBroker and WorkerCapacity into AteomSupport#1501Taahir Ahmed (ahmedtd) wants to merge 2 commits into
Taahir Ahmed (ahmedtd) wants to merge 2 commits into
Conversation
Taahir Ahmed (ahmedtd)
requested review from
Benjamin Elder (BenTheElder) and
Julian Gutierrez Oschmann (juli4n)
September 4, 2026 22:11
Benjamin Elder (BenTheElder)
left a comment
Benjamin Elder (BenTheElder)
left a comment
Collaborator
There was a problem hiding this comment.
second commit LGTM
This was originally a separate service to make it easy to apply separate authentication and authorization interceptors. It now seems clear that they should be in controlapi, with the same authn/z handlers chosen there. * Remove checks that will be handled in the authorizer framework.
Taahir Ahmed (ahmedtd)
force-pushed
the
ateomsupport-smoosh
branch
from
September 4, 2026 23:18
ee33926 to
f7ca38b
Compare
Comment on lines
+60
to
+72
| // Create a Substrate-issued JWT asserting the actor identity. | ||
| // | ||
| // * Called by the egress gateway when actor JWT injection is configured for outbound requests. | ||
| rpc MintActorJWT(MintActorJWTRequest) returns (MintActorJWTResponse) {} | ||
|
|
||
| // Create a Substrate-issued SPIFFE certificate asserting the actor identity. | ||
| // | ||
| // * Called by atelet to provision an atunnel with a certificate for | ||
| // communication with the egress gateway. TODO(ahmedtd): Migrate this use | ||
| // case to a distinct certificate to prevent actor/atunnel confusion. | ||
| // * Called by the egress gateway when actor client certificate injection is | ||
| // configured for outbound requests. | ||
| rpc MintActorCertificate(MintActorCertificateRequest) returns (MintActorCertificateResponse) {} |
Collaborator
There was a problem hiding this comment.
I'm not so sure I agree with this change. From a logical/security perspective these seem fairly different than the rest of these services. I understand that from an RBAC perspective we can treat them differently, but it can help to logically separate things which have different responsibilities.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We shouldn't have a bunch of different gRPC services for atelet to provide services to ateoms. Combine the two that currently exist into one (AteomSupport).
Stacked over #1315