atecontroller publishes actor JWT verification keys for ate-idp-server to serve - #2134

…tor JWTs (agent-substrate#2099)

Part of agent-substrate#1756.

- Adds `cmd/ate-idp-server`, which serves
`/.well-known/openid-configuration` and `/openid/v1/jwks` over HTTPS
with a servicedns credential bundle, so relying parties can verify actor
JWTs.
- Reads the actor JWT authority pool from `--actor-id-jwt-pool` with
`localjwtauthority.RefreshingPool`, the reader ate-api-server signs
with, and builds each document from it per request.
- Builds both documents at startup and exits if it can't. After that, a
request whose document can't be built gets a 500 rather than an empty or
stale set.
- Requires `--issuer` rather than deriving a default, so it can't
disagree with ateapi, and accepts only `https://<host>`, so the routes
are fixed. The check is the new `actoridjwt.ValidateIssuer`; the
discovery document moves out of `internal/oidcdiscovery` into the
server, its only user.
- Makes the EC case in `localjwtauthority.JWKS` explicit: P-256 with
fixed 32-byte coordinates and an error for any other curve, rather than
reading the coordinate size off the encoded point.
- Records in `docs/metrics/substrate.yaml` that it emits no metrics.

For reviewers: the pool holds the signing keys, so ate-idp-server will
mount the same Secret ate-api-server does, in place of the controller
and ConfigMap in agent-substrate#2134. ate-api-server and ate-setup still accept an
issuer with a path until the installer deploys ate-idp-server. It serves
`/healthz` but no `/readyz`. Nothing deploys it yet.

Testing: unit tests for routing, the host-only issuer check, the
discovery document, startup failures, key changes, 500s on a broken set,
the P-256 encoding, and required flags, plus a local run over TLS
against a generated pool. E2E can't cover it until it's deployed.

- [ ] Tests pass
- [ ] Appropriate changes to documentation are included in the PR

…tor JWTs (agent-substrate#2099)

Part of agent-substrate#1756.

- Adds `cmd/ate-idp-server`, which serves
`/.well-known/openid-configuration` and `/openid/v1/jwks` over HTTPS
with a servicedns credential bundle, so relying parties can verify actor
JWTs.
- Reads the actor JWT authority pool from `--actor-id-jwt-pool` with
`localjwtauthority.RefreshingPool`, the reader ate-api-server signs
with, and builds each document from it per request.
- Builds both documents at startup and exits if it can't. After that, a
request whose document can't be built gets a 500 rather than an empty or
stale set.
- Requires `--issuer` rather than deriving a default, so it can't
disagree with ateapi, and accepts only `https://<host>`, so the routes
are fixed. The check is the new `actoridjwt.ValidateIssuer`; the
discovery document moves out of `internal/oidcdiscovery` into the
server, its only user.
- Makes the EC case in `localjwtauthority.JWKS` explicit: P-256 with
fixed 32-byte coordinates and an error for any other curve, rather than
reading the coordinate size off the encoded point.
- Records in `docs/metrics/substrate.yaml` that it emits no metrics.

For reviewers: the pool holds the signing keys, so ate-idp-server will
mount the same Secret ate-api-server does, in place of the controller
and ConfigMap in agent-substrate#2134. ate-api-server and ate-setup still accept an
issuer with a path until the installer deploys ate-idp-server. It serves
`/healthz` but no `/readyz`. Nothing deploys it yet.

Testing: unit tests for routing, the host-only issuer check, the
discovery document, startup failures, key changes, 500s on a broken set,
the P-256 encoding, and required flags, plus a local run over TLS
against a generated pool. E2E can't cover it until it's deployed.

- [ ] Tests pass
- [ ] Appropriate changes to documentation are included in the PR

(cherry picked from commit 0877906)
Signed-off-by: Timo Derstappen <[email protected]>