ateom/actor ID split: Define MintAteomActorCertificate by ahmedtd · Pull Request #1626 · agent-substrate/substrate

Taahir Ahmed (ahmedtd) · 2026-09-12T03:30:32Z

We need to draw a strong distinction between credentials that will be wielded directly by actor logic, and credentials used by system components on behalf of an actor. This will help us avoid attacks where an actor pretends to be a system component.

Ateom certificates are requested by ateom/atelet and used for the atunnel connection to the egress gateway. They have a SPIFFE URI like spiffe://${trustdomain}/ateom-for-actor/${atespace}/${actor}.

Actor certificates are requested by the egress gateway and used for opening outbound requests on behalf of the actor. They have a SPIFFE URI like spiffe://${trustdomain}/actor/${atespace}/${actor}. Note, this use case is not actually implemented yet.

Lior Lieberman (LiorLieberman) · 2026-09-13T23:20:23Z

whats your view on adding another part "/x/" vs prefixing the existing part already - like spiffe://${trustdomain}/ateom-actor/${atespace}/${actor}

Wouldn't it ease regexes / validation in different component that uses that peer identity?

Lior Lieberman (LiorLieberman) · 2026-09-13T23:22:41Z

-type credentialBroker struct {
-	ateletpb.UnimplementedCredentialBrokerServer
-	controlClient ateapipb.ControlClient
+type ateomSupportServer struct {


whats the rationale behind "ateomSupportServer" name? whats ateomSupport?

It's a server to support ateoms by providing RPCs they need. I am not attached to the name. I just want to avoid having $n$ different services between atelet and ateom.

Eitan Yarmush (EItanya) · 2026-09-14T12:27:05Z

Stacked over #1501

Stacking over a PR which doesn't feel ready to go is confusing, can this work stand on its own?

Or even better can we get to the bottom of the questions in #1501 (comment) before marking these ready for review?

Taahir Ahmed (ahmedtd) · 2026-09-16T18:58:40Z

whats your view on adding another part "/x/" vs prefixing the existing part already - like spiffe://${trustdomain}/ateom-actor/${atespace}/${actor}

Wouldn't it ease regexes / validation in different component that uses that peer identity?

Yes, that's a good idea.

Taahir Ahmed (ahmedtd) · 2026-09-17T01:51:54Z

whats your view on adding another part "/x/" vs prefixing the existing part already - like spiffe://${trustdomain}/ateom-actor/${atespace}/${actor}
Wouldn't it ease regexes / validation in different component that uses that peer identity?

Yes, that's a good idea.

Done, I used ateom-for-actor

Taahir Ahmed (ahmedtd) · 2026-09-22T22:04:49Z

This PR grew pretty large, so I have split it into three.

This PR now only contains the definition and implementation of the new MintAteomActorCertificate RPC.
ateom/actor ID split: Ateom uses MintAteomActorCertificate #1809 makes atelet/ateom/atunnel use the new RPC
ateom/actor ID split: Clean up purpose from MintActorCertificate #1810 cleans up the now-unneeded purpose field.

Max Thompson (thompsonmax) · 2026-09-22T23:46:57Z

+  // Must be a valid actor that currently exists according to the actor store.
+  //
+  // +k8s:required
+  ObjectRef actor = 6;


Why are we starting field numbers at 6 for a brand new message?

Max Thompson (thompsonmax) · 2026-09-22T23:50:09Z

+	// Parse the CSR.
+	csr, err := x509.ParseCertificateRequest(req.GetCertificateSigningRequest())
+	if err != nil {
+		return nil, fmt.Errorf("while parsing CSR: %w", err)


Should this return InvalidArgument?

Max Thompson (thompsonmax) · 2026-09-22T23:51:44Z

+  //
+  // Must be a valid actor that currently exists according to the actor store.
+  //
+  // +k8s:required


Other actor references include "+k8s:subfield(atespace)=+k8s:required," to ensure an atespace is specified, should we require that here as well?

Max Thompson (thompsonmax) · 2026-09-22T23:56:18Z

+		return nil, fmt.Errorf("while parsing CSR: %w", err)
+	}
+	if err := csr.CheckSignature(); err != nil {
+		slog.ErrorContext(ctx, "Failed to verify CSR signature", slog.Any("err", err))


[nit] This can be triggered by the client providing a bad signature on a CSR, so should we log at WARN rather than ERROR?

I don't think we need to log this, actually, I just switched it up so the error is returned. This doesn't seem like a sensitive error that we need to hide, it's post-authn/z

Max Thompson (thompsonmax) · 2026-09-22T23:58:11Z

+  // leaf certificate, and any remaining entries are intermediates in
+  // leaf-to-root order.
+  repeated bytes actor_certificates = 1;
+}


[nit] dropped the trailing newline here

We need to draw a strong distinction between credentials that will be wielded directly by actor logic, and credentials used by system components on behalf of an actor. This will help us avoid attacks where an actor pretends to be a system component. Ateom certificates are requested by ateom/atelet and used for the atunnel connection to the egress gateway. They have a SPIFFE URI like spiffe://${trustdomain}/ateom-for-actor/${atespace}/${actor}. (Right now, there is no use for a similar JWT, but one could be added).

Lior Lieberman (LiorLieberman) · 2026-09-23T17:17:36Z

are you planning to update whatever is using the purpose field on the cert to use the new format?

Taahir Ahmed (ahmedtd) · 2026-09-23T17:18:24Z

are you planning to update whatever is using the purpose field on the cert to use the new format?

Yes, there are other stacked PRs over this, #1809 and #1810

Taahir Ahmed (ahmedtd) requested review from Eitan Yarmush (EItanya), Lior Lieberman (LiorLieberman) and Shruti Nair (SHRUTI6991) September 12, 2026 03:31

Taahir Ahmed (ahmedtd) added the area/identity label Sep 12, 2026

Lior Lieberman (LiorLieberman) reviewed Sep 13, 2026

View reviewed changes

Taahir Ahmed (ahmedtd) force-pushed the separate-certs branch 3 times, most recently from c504250 to ae3f3a2 Compare September 17, 2026 01:50

Taahir Ahmed (ahmedtd) force-pushed the separate-certs branch 3 times, most recently from c271e09 to a7d525c Compare September 17, 2026 04:45

Bowei Du (bowei) added kind/feature An enhancement / feature request or implementation area/security Security related issue/pr labels Sep 17, 2026

Taahir Ahmed (ahmedtd) force-pushed the separate-certs branch from a7d525c to 3bcd865 Compare September 22, 2026 22:00

Taahir Ahmed (ahmedtd) mentioned this pull request Sep 22, 2026

ateom/actor ID split: Ateom uses MintAteomActorCertificate #1809

Merged

Taahir Ahmed (ahmedtd) requested review from Max Thompson (thompsonmax) and removed request for Shruti Nair (SHRUTI6991) September 22, 2026 22:08

Max Thompson (thompsonmax) reviewed Sep 23, 2026

View reviewed changes

Taahir Ahmed (ahmedtd) force-pushed the separate-certs branch 5 times, most recently from cd5be8e to b5b38fd Compare September 23, 2026 04:18

Taahir Ahmed (ahmedtd) changed the title ~~Separate ateom certificates vs direct actor certificates~~ ateom/actor ID split: Define MintAteomActorCertificate Sep 23, 2026

Taahir Ahmed (ahmedtd) enabled auto-merge September 23, 2026 05:46

Taahir Ahmed (ahmedtd) force-pushed the separate-certs branch from b5b38fd to aba8c69 Compare September 23, 2026 16:49

Lior Lieberman (LiorLieberman) approved these changes Sep 23, 2026

View reviewed changes

Haven Xia (HavenXia) approved these changes Sep 23, 2026

View reviewed changes

Taahir Ahmed (ahmedtd) added this pull request to the merge queue Sep 23, 2026

Merged via the queue into agent-substrate:main with commit 8ea4abe Sep 23, 2026
11 checks passed

Conversation

Taahir Ahmed (ahmedtd) commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lior Lieberman (LiorLieberman) commented Sep 13, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Eitan Yarmush (EItanya) commented Sep 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Taahir Ahmed (ahmedtd) commented Sep 16, 2026

Uh oh!

Taahir Ahmed (ahmedtd) commented Sep 17, 2026

Uh oh!

Taahir Ahmed (ahmedtd) commented Sep 22, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Lior Lieberman (LiorLieberman) commented Sep 23, 2026

Uh oh!

Taahir Ahmed (ahmedtd) commented Sep 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Taahir Ahmed (ahmedtd) commented Sep 12, 2026 •

edited

Loading

Eitan Yarmush (EItanya) commented Sep 14, 2026 •

edited

Loading