feat(auth): add SPIFFE supervisor authentication#1414

Open

TaylorMutch wants to merge 21 commits into

tmutch/per-supervisor-authnfrom

tmutch/supervisor-authn-spiffe

Commits on May 19, 2026

refactor(server): introduce Authenticator trait and Principal enum
TaylorMutch
committed
feat(server): gateway-minted sandbox JWTs and IssueSandboxToken RPC
TaylorMutch
committed
feat(server)!: per-sandbox JWT identity over Bearer (wire break)
TaylorMutch
committed
fix(sandbox): strip supervisor-only credentials from entrypoint env
TaylorMutch
committed
fix(server): per-handler sandbox_id equality check (closes #1354)
TaylorMutch
committed
feat(server): RefreshSandboxToken RPC + sandbox refresh loop
TaylorMutch
committed
feat(server): make K8s ServiceAccount bootstrap token TTL configurable
TaylorMutch
committed
feat(server): JWKS-based K8s ServiceAccount token validation
TaylorMutch
committed
fix(server): three sandbox-identity issues found during helm exercise
TaylorMutch
committed
feat(sandbox): openshell-sandbox debug-rpc subcommand for end-to-end testing
TaylorMutch
committed
fix(helm): mount sandbox JWT keys without TLS
TaylorMutch
committed
test(e2e): configure sandbox JWT keys in harnesses
TaylorMutch
committed
refactor(auth): remove sandbox token revocation
TaylorMutch
committed
test(server): fix rebased test fixtures
TaylorMutch
committed
docs(helm): update chart values reference
TaylorMutch
committed
chore(markdown): ignore local architecture plans
TaylorMutch
committed
fix(server): restrict sandbox principal RPC access
TaylorMutch
committed
fix(server): validate k8s serviceaccount tokens with tokenreview
TaylorMutch
committed
fix(server): allow sandbox inference bundle fetch
TaylorMutch
committed
fix(server): treat podman created state as provisioning
TaylorMutch
committed

Commits on May 20, 2026

feat(auth): add SPIFFE supervisor authentication
TaylorMutch
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(auth): add SPIFFE supervisor authentication#1414

feat(auth): add SPIFFE supervisor authentication#1414
TaylorMutch wants to merge 21 commits into
tmutch/per-supervisor-authnfrom
tmutch/supervisor-authn-spiffe

Commits on May 19, 2026

refactor(server): introduce Authenticator trait and Principal enum

feat(server): gateway-minted sandbox JWTs and IssueSandboxToken RPC

feat(server)!: per-sandbox JWT identity over Bearer (wire break)

fix(sandbox): strip supervisor-only credentials from entrypoint env

fix(server): per-handler sandbox_id equality check (closes #1354)

feat(server): RefreshSandboxToken RPC + sandbox refresh loop

feat(server): make K8s ServiceAccount bootstrap token TTL configurable

feat(server): JWKS-based K8s ServiceAccount token validation

fix(server): three sandbox-identity issues found during helm exercise

feat(sandbox): openshell-sandbox debug-rpc subcommand for end-to-end testing

fix(helm): mount sandbox JWT keys without TLS

test(e2e): configure sandbox JWT keys in harnesses

refactor(auth): remove sandbox token revocation

test(server): fix rebased test fixtures

docs(helm): update chart values reference

chore(markdown): ignore local architecture plans

fix(server): restrict sandbox principal RPC access

fix(server): validate k8s serviceaccount tokens with tokenreview

fix(server): allow sandbox inference bundle fetch

fix(server): treat podman created state as provisioning

Commits on May 20, 2026

feat(auth): add SPIFFE supervisor authentication