Decision 0051 to write: regions with federated root CAs #60

New issue

Open

opened 2026-10-04 19:40:41 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-04 19:40:41 -03:00

(Migrated from github.com)

Maintainer decisions of 2026-10-04 (answered 'sim' to all three):

Finish etcd (keel#78) with a single region: the root CA signs every member intermediate, relayed by the inviter; if the root is unreachable, the mesh join completes and etcd membership waits. The format must already allow several roots (a trust bundle and a region field), so regions need no rework.
Write decision 0051, 'Regions and federated root CAs': each region has its own autonomous root CA on its primary node; new nodes in a region are certified locally, which suits the 250 ms premise (0050) and survives losing the international link; if a region's root is down, its nodes ask another region's root; etcd trusts the bundle of all region roots (etcd accepts several CAs); the etcd quorum stays one cluster across regions, and only issuance and revocation are federated.
A new region (a new root) is valid only with signatures from a majority of the existing roots; each root revokes only what it issued; revoking a whole root also needs a majority.
Supersedes the third-round Q1 wording of 0048 ('signed by its inviter'). Open points for the note: where each root key lives and its backup, cross-certificate lifetimes, CRL merging across roots, and how a region is declared in the spec.

Maintainer decisions of 2026-10-04 (answered 'sim' to all three): 1. Finish etcd (keel#78) with a single region: the root CA signs every member intermediate, relayed by the inviter; if the root is unreachable, the mesh join completes and etcd membership waits. The format must already allow several roots (a trust bundle and a region field), so regions need no rework. 2. Write decision 0051, 'Regions and federated root CAs': each region has its own autonomous root CA on its primary node; new nodes in a region are certified locally, which suits the 250 ms premise (0050) and survives losing the international link; if a region's root is down, its nodes ask another region's root; etcd trusts the bundle of all region roots (etcd accepts several CAs); the etcd quorum stays one cluster across regions, and only issuance and revocation are federated. 3. A new region (a new root) is valid only with signatures from a majority of the existing roots; each root revokes only what it issued; revoking a whole root also needs a majority. Supersedes the third-round Q1 wording of 0048 ('signed by its inviter'). Open points for the note: where each root key lives and its backup, cross-certificate lifetimes, CRL merging across roots, and how a region is declared in the spec.