grant-issuer

Overview ¶

Command grant-issuer is the reference issuer: it holds one signing key, mints CapacityGrant JWTs, and serves the OIDC discovery document and JWKS that homes verify against.

grant-issuer keygen -alg EdDSA -out key.json
grant-issuer keygen -alg A256GCM -out seal.json   also writes fleet-pub.json beside it
grant-issuer mint   -key key.json -issuer http://issuer:8686 -aud node-a \
                    -tenant team-a -template sha256:... -max 8 -warm 2 -w-budget 64Mi \
                    -min-tier FIBER_WARM -isolation TRUSTED -ttl 10m > grant.jwt
grant-issuer serve  -key key.json -addr :8686 [-issuer http://issuer:8686]

A control plane runs the same issuer (pkg/grant.Issuer) inside itself; the Kubernetes controller, github.com/Azure/fiberd-k8s-controller, is one.