kind: authenticate node-api and build-manager callers by TokenReview

.gitleaks.toml

@@ -9,13 +9,6 @@ condition = "AND"
 paths = ['''^infra/space/kind/charts/space-api-local/values\.yaml$''']
 regexes = ['''^-----BEGIN[ ]PRIVATE KEY-----\r?\n[ \t]*MC4CAQAwBQYDK2VwBCIEIJ1hsZ3v/VpguoRK9JLsLMREScVpezJpGXA7rAMcrn9g\r?\n[ \t]*-----END[ ]PRIVATE KEY-----$''']
 
-[[allowlists]]
-description = "Negative TokenReview fixture with a literal fake signature"
-targetRules = ["jwt"]
-condition = "AND"
-paths = ['''^scripts/k8s/projected-tokens/02-test\.sh$''']
-regexes = ['''^eyJhbGciOiJSUzI1NiIsImtpZCI6ImJvZ3VzIn0[.]eyJzdWIiOiJmYWtlIiwiYXVkIjpbInNwYWNlLW5vZGUtYXBpIl19[.]ZmFrZXNpZ25hdHVyZQ$''']
-
 # Diff scans read context lines too, so edits near these fixtures surface it.
 [[allowlists]]
 description = "Synthetic credential-reference UUID shared by credential test fixtures"

crates/libs/common/svc/src/auth/k8s.rs

@@ -21,7 +21,7 @@ use super::{
 };
 
 // The namespace is read from the pod's service account mount. The override is a
-// test hook for in-process tests and kind, which have no such mount.
+// test hook for in-process tests, which have no such mount.
 const SPACE_K8S_TOKEN_AUTH_NAMESPACE_ENV: &str = "SPACE_K8S_TOKEN_AUTH_NAMESPACE";
 const SPACE_K8S_TOKEN_AUTH_REVIEW_RATE_PER_SEC_ENV: &str =
     "SPACE_K8S_TOKEN_AUTH_REVIEW_RATE_PER_SEC";

docker/Dockerfile.rust-build-kind

@@ -50,7 +50,7 @@ COPY infra/space/identity/node-identities.sh infra/space/identity/node-identitie
 # space-runtime-supervisor-svc is cooked here but built by
 # scripts/build-runtime-supervisor.sh below, as the production worker stage does.
 RUN cargo chef cook --locked --release --recipe-path recipe.json \
-      --features "pplx-space-node-api-svc/otel,pplx-space-node-api-svc/datadog,pplx-space-node-api-svc/k8s,pplx-space-internal-api-svc/otel,pplx-space-internal-api-svc/datadog,pplx-space-internal-api-svc/k8s,pplx-space-node-ctl-svc/otel,pplx-space-node-ctl-svc/datadog,pplx-space-node-ctl-svc/kubernetes,pplx-space-node-mgr-svc/otel,pplx-space-node-mgr-svc/datadog,pplx-space-build-mgr-svc/otel,pplx-space-build-mgr-svc/datadog,pplx-space-runtime-supervisor-svc/otel,pplx-space-runtime-supervisor-svc/datadog,pplx-space-runtime-manager-svc/otel,pplx-space-runtime-manager-svc/datadog,pplx-space-sbxmgr-svc/otel,pplx-space-sbxmgr-svc/datadog,pplx-space-spaced-host-svc/otel,pplx-space-spaced-host-svc/datadog,pplx-space-net-gateway-svc/otel,pplx-space-net-gateway-svc/datadog,pplx-space-tmplmgr-svc/otel,pplx-space-tmplmgr-svc/datadog,pplx-space-volmgr-svc/otel,pplx-space-volmgr-svc/datadog,pplx-space-api-svc/otel,pplx-space-api-svc/datadog,pplx-space-api-svc/kubernetes,pplx-space-api-svc/federated-identity,pplx-space-data-plane-svc/otel,pplx-space-data-plane-svc/datadog,pplx-space-data-plane-svc/kubernetes,pplx-space-cluster-controller/otel,pplx-space-cluster-controller/datadog,pplx-space-spaced-guest-svc/test-hooks,pplx-space-node-mgr-svc/test-hooks,pplx-space-sbxmgr-svc/test-hooks,pplx-space-tmplmgr-svc/test-hooks,pplx-space-template-mgr/test-hooks,pplx-space-internal-api-server/test-hooks,pplx-space-credmgr/test-hooks,pplx-space-common-svc/test-hooks,pplx-space-spaced-guest-server/test-hooks,pplx-space-observability/test-hooks,pplx-space-cluster-controller-server/test-hooks,pplx-space-common-core/test-hooks,pplx-space-sbx-mgr/test-hooks,pplx-space-api/test-hooks,pplx-space-build-mgr-server/test-hooks,pplx-space-node-api-server/test-hooks,pplx-space-node-mgr/test-hooks" \
+      --features "pplx-space-node-api-svc/otel,pplx-space-node-api-svc/datadog,pplx-space-node-api-svc/k8s,pplx-space-internal-api-svc/otel,pplx-space-internal-api-svc/datadog,pplx-space-internal-api-svc/k8s,pplx-space-node-ctl-svc/otel,pplx-space-node-ctl-svc/datadog,pplx-space-node-ctl-svc/kubernetes,pplx-space-node-mgr-svc/otel,pplx-space-node-mgr-svc/datadog,pplx-space-build-mgr-svc/otel,pplx-space-build-mgr-svc/datadog,pplx-space-build-mgr-svc/k8s,pplx-space-runtime-supervisor-svc/otel,pplx-space-runtime-supervisor-svc/datadog,pplx-space-runtime-manager-svc/otel,pplx-space-runtime-manager-svc/datadog,pplx-space-sbxmgr-svc/otel,pplx-space-sbxmgr-svc/datadog,pplx-space-spaced-host-svc/otel,pplx-space-spaced-host-svc/datadog,pplx-space-net-gateway-svc/otel,pplx-space-net-gateway-svc/datadog,pplx-space-tmplmgr-svc/otel,pplx-space-tmplmgr-svc/datadog,pplx-space-volmgr-svc/otel,pplx-space-volmgr-svc/datadog,pplx-space-api-svc/otel,pplx-space-api-svc/datadog,pplx-space-api-svc/kubernetes,pplx-space-api-svc/federated-identity,pplx-space-data-plane-svc/otel,pplx-space-data-plane-svc/datadog,pplx-space-data-plane-svc/kubernetes,pplx-space-cluster-controller/otel,pplx-space-cluster-controller/datadog,pplx-space-spaced-guest-svc/test-hooks,pplx-space-node-mgr-svc/test-hooks,pplx-space-sbxmgr-svc/test-hooks,pplx-space-tmplmgr-svc/test-hooks,pplx-space-template-mgr/test-hooks,pplx-space-internal-api-server/test-hooks,pplx-space-credmgr/test-hooks,pplx-space-common-svc/test-hooks,pplx-space-spaced-guest-server/test-hooks,pplx-space-observability/test-hooks,pplx-space-cluster-controller-server/test-hooks,pplx-space-common-core/test-hooks,pplx-space-sbx-mgr/test-hooks,pplx-space-api/test-hooks,pplx-space-build-mgr-server/test-hooks,pplx-space-node-api-server/test-hooks,pplx-space-node-mgr/test-hooks" \
       --bin spaced \
       --bin spaced-svc \
       --bin space-buildmgr \
@@ -100,6 +100,7 @@ RUN cargo build --locked --release \
       -F pplx-space-node-ctl-svc/kubernetes \
       -F pplx-space-node-mgr-svc/otel,pplx-space-node-mgr-svc/datadog \
       -F pplx-space-build-mgr-svc/otel,pplx-space-build-mgr-svc/datadog \
+      -F pplx-space-build-mgr-svc/k8s \
       -F pplx-space-runtime-manager-svc/otel,pplx-space-runtime-manager-svc/datadog \
       -F pplx-space-sbxmgr-svc/otel,pplx-space-sbxmgr-svc/datadog \
       -F pplx-space-spaced-host-svc/otel,pplx-space-spaced-host-svc/datadog \

docs/configuration.md

@@ -334,11 +334,52 @@ authentication is enabled, static fallback has no transfer authority.
 Missing authentication context is denied. Local root/operator exports remain
 available through template-manager's Unix socket.
 
+A peer transfer has two callers, and each needs the grant and admission by
+`SPACE_NODE_API_AUTH_ALLOWED_SERVICE_ACCOUNTS` on the node it calls. The caller
+of `PullTemplate` on the target node starts it: the admin API's node
+template-pull route, which only the direct substrate serves, or an operator
+calling node-api directly. The target's node-api then calls
+`NodeExportTemplate` on the source node with its own `SPACE_NODE_API_TOKEN_PATH`
+token. List the account that starts pulls and the node-api account of every
+role that can be a target. An empty list disables peer
+transfers and node-api logs a startup warning. A deployment without peer
+transfers may leave it empty.
+
 Exact-digest export can use the local cache offline. An omitted digest resolves
 the requested catalog tag (default `latest`) and exports only that digest; a
 missing tag, unavailable catalog, or uncached resolved digest fails without
 falling back to a newer local build.
 
+### Policy authorization
+
+Before enabling Kubernetes authentication or upgrading an authenticated worker
+or builder, set `SPACE_NODE_API_AUTH_TRUSTED_POLICY_SERVICE_ACCOUNTS` to the
+service accounts that own policy intent. It must be nonempty on both roles or
+node-api refuses to start. These accounts must also be admitted by the normal
+and internal surface allowlists for the RPCs they call. Policy trust is
+independent of the `SpacedWaitReady` trust set. Policy-bearing pool adoption
+uses the internal surface, so its caller needs an internal-audience token.
+
+Shared static-token fallback cannot mutate policy when Kubernetes
+authentication is enabled; static-only deployments retain that authority.
+Policy-bearing cold creation, internal pool adoption, and worker and builder
+template updates require a trusted caller. Cold creation and pool adoption also
+require policy authority for a nonzero sandbox-policy generation, even without
+an override. Requests with no overrides and generation zero remain available to
+otherwise admitted callers and inherit the template's policy. Guest-bridge
+accounts already have separate method restrictions.
+
+`Local` policy is node-administrator-owned, including normal standalone use and
+operator overrides on cluster-managed nodes. It requires a root or Operator Unix
+socket peer. Forwarders such as node-api and node-ctl must run under their
+dedicated non-root identities: UID 0 is classified as Root before the
+service-account lookup.
+
+Forwarded imports carrying `Local` network or auto-lifecycle policy are
+rejected, and retrying does not help. To retain `Local` policy, an operator must
+review its ownership and perform the import through an authorized local peer;
+forwarding never relabels it.
+
 ## Database
 
 | Variable | Notes |

infra/space/cluster/chart/values-builder.yaml

@@ -46,6 +46,30 @@ space-node-api-local:
   # kind/charts/space-node-api-local/values-builder.yaml
   serviceName: space-builder-node-api
   buildManagerEndpoint: https://space-builder-build-manager:9900
+  # The builder's TokenReview allowlists, which replace the worker's
+  # (values.yaml), as the same file sets them; without the template-build
+  # grant every BuildTemplate call would be refused.
+  auth:
+    SPACE_NODE_API_AUTH_ALLOWED_SERVICE_ACCOUNTS:
+      - space-api
+      - space-cluster-controller
+      - space-node-api
+      - space-builder-node-api
+    SPACE_NODE_API_INTERNAL_AUTH_ALLOWED_SERVICE_ACCOUNTS: []
+    SPACE_NODE_API_AUTH_TRUSTED_WAIT_READY_SERVICE_ACCOUNTS: []
+    SPACE_NODE_API_AUTH_TRUSTED_POLICY_SERVICE_ACCOUNTS:
+      - space-api
+    SPACE_NODE_API_AUTH_GUEST_BRIDGE_SERVICE_ACCOUNTS: []
+    SPACE_NODE_API_AUTH_TEMPLATE_TRANSFER_SERVICE_ACCOUNTS:
+      - space-api
+      - space-node-api
+      - space-builder-node-api
+    SPACE_NODE_API_AUTH_TEMPLATE_BUILD_SERVICE_ACCOUNTS:
+      - space-api
+    SPACE_BUILD_AUTH_SYSTEM_SERVICE_ACCOUNTS:
+      - space-api
+    SPACE_BUILD_AUTH_TENANT_SERVICE_ACCOUNTS:
+      - space-api
 space-build-manager-local:
   node:
     role: builder