Repository navigation
docs: fix the boundaries page - #784
Merged
Merged
Conversation
The boundaries page said the control plane generates its signing keys, stores them in its database and rotates them on the schedule you set. That is the default only. With --signing-key-path the operator supplies the keys in a PEM file and the control plane runs no rotation loop (cmd/agentmesh-control-plane/main.go:208, internal/controlplane/server.go:355-376). A rotation is then a new first key in the file, which the control plane re-reads every 30 seconds (internal/controlplane/signingkeys.go:258-280). The previous key stays in the file until every credential it signed has expired (internal/controlplane/signingkeys.go:46-48).
The boundaries page said a ban takes effect on the next credential refresh and, through the mesh event, at once on every connected node. The event is one path. Every node also pulls the ban set from /revocations on each control plane sync, every 15 minutes by default (internal/node/controlplane_sync.go:92-113, internal/node/node.go:93). Every router pulls the ban set from /info on each of its syncs, every 5 minutes by default (internal/router/router.go:1105-1133, 1456, internal/router/config.go:44).
The boundaries and authorization pages said a provider that cannot show the required labels is skipped. They also said a provider whose credential cannot be fetched is treated as if it lacked the label. The node skips a provider only where it picks the provider itself, on the /v1 inference facade and on a CONNECT tunnel (internal/node/openai_facade.go:413-425, internal/node/egress_tunnel.go:427-446). On a request that names the provider the node refuses the request instead. A /mesh/<peer>/... route and a proxied A2A request answer 403 (internal/node/sidecar.go:828-839, internal/node/a2a_service.go:118-123), and call_remote_tool fails with an error (internal/node/mcp.go:350). A provider whose credential does not verify, or that does not answer, gets no request.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Code Review
This pull request updates the documentation for authorization and boundaries concepts. Specifically, it clarifies how required labels are verified and handled when a request names a provider versus when the node picks the provider itself (such as on /v1 inference endpoints and CONNECT tunnels). It also documents the --signing-key-path option for supplying signing keys via a PEM file, explains the immediate and pull-based revocation mechanisms for banned nodes and routers, and refines the description of how the system fails closed when a provider's credential fails verification or does not answer. There are no review comments provided, and I have no feedback to provide on these documentation updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The boundaries page tells an operator what each party in a mesh controls and what happens when something goes wrong. Three statements there disagree with the code: who supplies the signing keys, when a ban takes effect, and what a node does with a provider that fails the label check.
What changed
--signing-key-paththe operator supplies them in a PEM file. The control plane then does not rotate them and re-reads the file every 30 seconds. The page says how to rotate a supplied key./v1and on aCONNECTtunnel. The authorization page said the same and is corrected in the same commit.Scope
Verification