Repository navigation
runbooks: the identity key is rotated by a key made, listed and retired - #9
Merged
Merged
Conversation
identity-audit-failing had a TODO where a compromise needs a new key: the identity key was made once and could not be rotated (spin#1050). spin now makes the next key on `controlplane identity rotate`, trusts it only once the installation's document lists it (the Terraform module's identity_keys), overlaps the two, and retires the old one on the list `identity retire` prints. The compromise steps say that, in order, and key-rotation points there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the identity-audit-failing TODO (spin#1050) with the rotation steps that spin-stack/spin#1178 and spin-stack/spin-terraform-aws#114 make real.
After the access that opened the key is removed:
identity rotatemakes the next key and prints its kid and the list to apply.identity_keys. Both keys are published, and new tokens are signed with the new one.identity retire <old kid>prints the list with the old key retired once what it signed has ended. Apply it. Commits signed earlier still verify.key-rotation gets a short entry that points there. Verify now names what
jwks.jsonand the control plane's journal should show.Merge after spin-stack/spin#1178 is in the release spin's pin moves to.
Refs spin-stack/spin#1050
🤖 Generated with Claude Code