localjwtauthority: Prep for rotation support - #1313
Open
Taahir Ahmed (ahmedtd) wants to merge 1 commit into
Open
localjwtauthority: Prep for rotation support#1313Taahir Ahmed (ahmedtd) wants to merge 1 commit into
Taahir Ahmed (ahmedtd) wants to merge 1 commit into
Conversation
Taahir Ahmed (ahmedtd)
requested review from
Shruti Nair (SHRUTI6991) and
Max Thompson (thompsonmax)
August 29, 2026 05:17
Taahir Ahmed (ahmedtd)
force-pushed
the
ca-rotation
branch
from
August 29, 2026 05:27
ea0bf18 to
0bc0692
Compare
Open
Taahir Ahmed (ahmedtd)
force-pushed
the
ca-rotation
branch
from
September 2, 2026 00:39
0bc0692 to
ad3a0c1
Compare
* Add a RefreshingPool abstraction like localca.RefreshingPool. This provides caching (so we don't read the keys fresh from the filesystem) for each signing operation. * Extend ConcretePool so that it tracks which key is currently active for signing, instead of always picking the first key. A followup PR will add admin commands for actually rotating the JWT pool.
Taahir Ahmed (ahmedtd)
force-pushed
the
ca-rotation
branch
from
September 2, 2026 01:31
ad3a0c1 to
40e8d65
Compare
Max Thompson (thompsonmax)
left a comment
Max Thompson (thompsonmax)
left a comment
Collaborator
There was a problem hiding this comment.
Mostly LGTM, just some nits and potential testing gap
| actorIDCAPool, err := localca.NewRefreshingPool(*actorIDCAPoolFile) | ||
| if err != nil { | ||
| serverboot.Fatal(ctx, "while loading the Actor ID CA", err) | ||
| serverboot.Fatal(ctx, "while loading the Actor ID certificate authority pool: %w", err) |
Collaborator
There was a problem hiding this comment.
[nit] %w is printed verbatim because we're calling Fatal rather than Fatalf
| actorIdentitySrv := actoridentity.New(actorIdentityJWTIssuer, *actorIDJWTPoolFile, actorIDCAPool, persistence, workerCache) | ||
| actorIDJWTAuthorityPool, err := localjwtauthority.NewRefreshingPool(*actorIDJWTPoolFile) | ||
| if err != nil { | ||
| serverboot.Fatal(ctx, "while loading the Actor ID JWT authority pool: %w", err) |
Collaborator
There was a problem hiding this comment.
[nit] %w is printed verbatim because we're calling Fatal rather than Fatalf
| return "", fmt.Errorf("selected authority %q not present", p.ActiveForSigning) | ||
| } | ||
| } else { | ||
| // Fall back to first entry. |
Collaborator
There was a problem hiding this comment.
Should we have some TODO on removing this fall back at some point? (similar to the fallback on the CA pool impl)
| return "", fmt.Errorf("while marshaling payload: %w", err) | ||
| } | ||
|
|
||
| // TODO(ahmedtd): Select authority |
Collaborator
There was a problem hiding this comment.
[nit] stale TODO? Seems like you're selecting the authority here :)
| if err != nil { | ||
| t.Fatalf("MarshalECPrivateKey(): %v", err) | ||
| pool1 := &ConcretePool{ | ||
| Authorities: []*Authority{ca1}, |
Collaborator
There was a problem hiding this comment.
There's no tests here that exercise a pool that has multiple authorities set, unless I'm missing something. Should we add unit tests for that?
| // designated as active for signing. The rest are inactive, but are still | ||
| // trusted for verifying JWTs. | ||
| // | ||
| // The active/inactive desngination allows a Pool to be seamlessly rotated. |
Collaborator
There was a problem hiding this comment.
[typo] 'desngination' -> 'designation'
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A followup PR will add admin commands for actually rotating the JWT pool.