docs: 0048 and 0051 amendments, the root issues every etcd certificate (keel#83) #56

Merged

marcos-mendez merged 3 commits from docs/keel-83-root-issues-every-certificate into main

2026-10-08 06:39:38 -03:00

marcos-mendez commented

2026-10-08 04:14:17 -03:00

(Migrated from github.com)

Records the maintainer's decision of 2026-10-07 on Keel-Linux/keel#83 as amendments to 0048 (third round, point 1) and 0051 (Issuance), as the issue asks ("A handbook amendment records it").

0048: the root (a region root, 0051) issues every etcd certificate, relayed by the inviter; members hold no intermediate; CN = the member's mesh identity, SANs its /128; etcd auth on, VIP keys writable by the pair alone; renewal and new memberships wait while the root is unreachable; etcdctl over gRPC, gateway off; keel mesh etcd reissue for the live layout.
0051: the forward-compatible note asked for the CRL: members sign nothing, so the merged CRL of several roots is signed by a root's holder and taken by a member only when its entries are the union it computed from each root's own CRL. Also the threat-model consequences.

Implementation: Keel-Linux/keel (branch feat/etcd-root-issued-rbac) and Keel-Linux/common (feat/etcd-client-for-keel).

Records the maintainer's decision of 2026-10-07 on Keel-Linux/keel#83 as amendments to 0048 (third round, point 1) and 0051 (Issuance), as the issue asks ("A handbook amendment records it"). - 0048: the root (a region root, 0051) issues every etcd certificate, relayed by the inviter; members hold no intermediate; CN = the member's mesh identity, SANs its /128; etcd auth on, VIP keys writable by the pair alone; renewal and new memberships wait while the root is unreachable; etcdctl over gRPC, gateway off; `keel mesh etcd reissue` for the live layout. - 0051: the forward-compatible note asked for the CRL: members sign nothing, so the merged CRL of several roots is signed by a root's holder and taken by a member only when its entries are the union it computed from each root's own CRL. Also the threat-model consequences. Implementation: Keel-Linux/keel (branch feat/etcd-root-issued-rbac) and Keel-Linux/common (feat/etcd-client-for-keel).