Repository navigation
Generate the actor identity CA with ECDSA P-256 so external relying parties accept it - #3251
Merged
Eitan Yarmush (EItanya) merged 1 commit intoOct 27, 2026
Conversation
External relying parties verify actor certificates against the actor identity root, and many of them accept RSA and ECDSA roots but not Ed25519. A new install's actor-id-ca-pool could therefore not be used as a trust anchor outside the cluster without hand-replacing the CA. ate-setup now generates actor-id-ca-pool with ECDSA P-256, the same way it already generated egress-mitm-ca-pool. The pod identity, service DNS and postgres pools are only validated inside the cluster and stay Ed25519. kubectl ate admin make-ca-pool now defaults --key-type to ECDSAP256, so a hand-made pool is broadly accepted unless Ed25519 is asked for. Existing pools are kept on upgrade, so installed clusters keep their current root until it is rotated. Signed-off-by: Greg Castle <[email protected]>
Taahir Ahmed (ahmedtd)
approved these changes
Oct 26, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to Branch Protection failures
Oct 26, 2026
You're not authorized to push to this branch. Visit "About protected branches" for more information.
Collaborator
Author
|
LMK if there's a special dance I need to do for getting this in under freeze rules. |
Collaborator
We think it had to do with the new DCO check + merge queue. Should be fixed now |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New installs generated an Ed25519 actor identity CA, which many external relying parties don't accept as a trust anchor.
ate-setupnow generatesactor-id-ca-poolwith ECDSA P-256, the same way it already generatedegress-mitm-ca-pool. Cluster-internal pools (pod identity, service DNS, postgres) stay Ed25519.kubectl ate admin make-ca-pool --key-typenow defaults toECDSAP256. Pass--key-type ED25519for pools that are only validated inside the cluster.AI use: AI-assisted, I reviewed and tested it.