controlplane

package
v0.1.0-alpha.9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 7, 2026 License: Apache-2.0 Imports: 37 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	EnrollRateLimit        = 10
	EnrollBurst            = 20
	JWTVerificationTimeout = 10 * time.Second
)

Variables

This section is empty.

Functions

This section is empty.

Types

type MeshAdapter 

type MeshAdapter interface {
	// PublishEvent constructs, signs, and broadcasts a Control Plane MeshEvent (POLICY_UPDATE, BANNED, KEY_ROTATION).
	PublishEvent(ctx context.Context, eventType api.MeshEvent_Type, peerID string, payload []byte) error

	// DiscoverServices queries active mesh nodes/DHT for services matching a type or pattern.
	DiscoverServices(ctx context.Context, serviceType string) ([]*ServiceAnnouncement, error)

	// GetNodeStatus retrieves node reachability and status from the mesh.
	GetNodeStatus(ctx context.Context, peerID string) (*NodeStatus, error)

	// Close gracefully releases any P2P host resources, streams, and PubSub topics.
	Close() error
}

MeshAdapter defines the generic interface for Control Plane operations interacting with the Sovereign Agent Mesh.

type NodeStatus 

type NodeStatus struct {
	PeerID      string
	IsReachable bool
	Addresses   []string
	LastSeen    time.Time
}

NodeStatus represents mesh status information for a peer.

type NopMeshAdapter 

type NopMeshAdapter struct{}

NopMeshAdapter provides a no-op implementation used when P2P mesh integration is disabled or in unit tests.

func NewNopMeshAdapter 

func NewNopMeshAdapter() *NopMeshAdapter

func (*NopMeshAdapter) Close 

func (n *NopMeshAdapter) Close() error

func (*NopMeshAdapter) DiscoverServices 

func (n *NopMeshAdapter) DiscoverServices(ctx context.Context, serviceType string) ([]*ServiceAnnouncement, error)

func (*NopMeshAdapter) GetNodeStatus 

func (n *NopMeshAdapter) GetNodeStatus(ctx context.Context, peerID string) (*NodeStatus, error)

func (*NopMeshAdapter) PublishEvent 

func (n *NopMeshAdapter) PublishEvent(ctx context.Context, eventType api.MeshEvent_Type, peerID string, payload []byte) error

type Options 

type Options struct {
	ListenAddr            string
	DriverName            string
	DataSourceName        string
	OIDCIssuer            string
	OIDCClientID          string // OAuth client id advertised via /info; defaults to the first allowed audience
	AllowedAudiences      []string
	LeaseDuration         time.Duration
	KeyRotationInterval   time.Duration
	KeyGracePeriod        time.Duration
	InsecureSkipTLSVerify bool
	BiscuitTimeout        time.Duration
	BiscuitTTL            time.Duration // Lifespan minted into every issued Biscuit's expiration() fact; defaults to api.BiscuitTokenTTL
	OIDCSessionTTL        time.Duration // How long an OIDC enrollment stays refreshable before the identity must re-authenticate interactively; defaults to api.OIDCSessionTTL
	AdminToken            string        // Optional: administrative bearer token for protecting policy and enrollment queue REST APIs
	AutoApproveEnrollment bool          // If true, valid bootstrap token enrollment requests are immediately approved without administrative manual gate
}

Options holds configuration for the control plane.

func (*Options) Default 

func (o *Options) Default()

Default sets default values for control plane options.

func (*Options) Validate 

func (o *Options) Validate() error

Validate ensures options are valid.

type P2PMeshAdapter 

type P2PMeshAdapter struct {
	// contains filtered or unexported fields
}

P2PMeshAdapter implements MeshAdapter using a libp2p Host and GossipSub subscriber/publisher.

func NewP2PMeshAdapter 

func NewP2PMeshAdapter(h host.Host, ps *pubsub.PubSub, store storage.Store) (*P2PMeshAdapter, error)

func (*P2PMeshAdapter) Close 

func (p *P2PMeshAdapter) Close() error

func (*P2PMeshAdapter) ConnectPeer 

func (p *P2PMeshAdapter) ConnectPeer(ctx context.Context, targetAddr string) error

func (*P2PMeshAdapter) DiscoverServices 

func (p *P2PMeshAdapter) DiscoverServices(ctx context.Context, serviceType string) ([]*ServiceAnnouncement, error)

func (*P2PMeshAdapter) GetNodeStatus 

func (p *P2PMeshAdapter) GetNodeStatus(ctx context.Context, peerID string) (*NodeStatus, error)

func (*P2PMeshAdapter) PublishEvent 

func (p *P2PMeshAdapter) PublishEvent(ctx context.Context, eventType api.MeshEvent_Type, peerID string, payload []byte) error

type Server 

type Server struct {
	// contains filtered or unexported fields
}

Server implements the SAM Control Plane web app.

func NewServer 

func NewServer(config Options, store storage.Store) (*Server, error)

NewServer initializes the control plane server and stores configuration.

func (*Server) Addr 

func (s *Server) Addr() string

Addr returns the network address the server is listening on.

func (*Server) Close 

func (s *Server) Close() error

Close shuts down background loops and HTTP server.

func (*Server) HandleAdminBootstrapTokens 

func (s *Server) HandleAdminBootstrapTokens(w http.ResponseWriter, r *http.Request)

HandleAdminBootstrapTokens HTTP POST/GET `/admin/bootstrap-tokens`

func (*Server) HandleAdminEnrollmentAction 

func (s *Server) HandleAdminEnrollmentAction(w http.ResponseWriter, r *http.Request)

HandleAdminEnrollmentAction HTTP POST `/admin/enrollments/{id}/approve` or `/admin/enrollments/{id}/reject`

func (*Server) HandleAdminEnrollments 

func (s *Server) HandleAdminEnrollments(w http.ResponseWriter, r *http.Request)

HandleAdminEnrollments HTTP GET `/admin/enrollments`

func (*Server) HandleAdminRevoke 

func (s *Server) HandleAdminRevoke(w http.ResponseWriter, r *http.Request)

HandleAdminRevoke HTTP POST `/admin/revoke`

func (*Server) HandleAdminStatus 

func (s *Server) HandleAdminStatus(w http.ResponseWriter, r *http.Request)

HandleAdminStatus returns a consolidated JSON state of the control plane.

func (*Server) HandleEnroll 

func (s *Server) HandleEnroll(w http.ResponseWriter, r *http.Request)

HandleEnroll HTTP POST `/enroll`

func (*Server) HandleEnrollStatus 

func (s *Server) HandleEnrollStatus(w http.ResponseWriter, r *http.Request)

HandleEnrollStatus HTTP GET `/enroll/status`

The approved response carries the enrollee's Biscuit, so polling requires proof of possession of the key submitted at /enroll: the api.HeaderChallengeTimestamp header (unix milliseconds) and the api.HeaderChallengeSignature header (unpadded base64url signature over api.EnrollStatusChallenge) must accompany `peer_id`. Every failure mode after the header parse answers a uniform 401 so the endpoint is not a peer-ID existence oracle for anonymous callers.

func (*Server) HandleHealthz 

func (s *Server) HandleHealthz(w http.ResponseWriter, r *http.Request)

HandleHealthz HTTP GET `/healthz`

func (*Server) HandleInfo 

func (s *Server) HandleInfo(w http.ResponseWriter, r *http.Request)

HandleInfo HTTP GET `/info`

func (*Server) HandleKeys 

func (s *Server) HandleKeys(w http.ResponseWriter, r *http.Request)

HandleKeys HTTP GET `/keys`

func (*Server) HandlePolicies 

func (s *Server) HandlePolicies(w http.ResponseWriter, r *http.Request)

HandlePolicies HTTP GET/POST/PUT `/policies`

func (*Server) HandleReadyz 

func (s *Server) HandleReadyz(w http.ResponseWriter, r *http.Request)

HandleReadyz HTTP GET `/readyz`

func (*Server) HandleRefresh 

func (s *Server) HandleRefresh(w http.ResponseWriter, r *http.Request)

HandleRefresh HTTP POST `/refresh`

func (*Server) HandleRegister 

func (s *Server) HandleRegister(w http.ResponseWriter, r *http.Request)

HandleRegister HTTP POST `/register`

func (*Server) HandleRouterLease 

func (s *Server) HandleRouterLease(w http.ResponseWriter, r *http.Request)

HandleRouterLease HTTP POST `/routers/lease`

func (*Server) HandleUserBootstrapTokens 

func (s *Server) HandleUserBootstrapTokens(w http.ResponseWriter, r *http.Request)

func (*Server) HandleUserRevoke 

func (s *Server) HandleUserRevoke(w http.ResponseWriter, r *http.Request)

func (*Server) HandleUserStatus 

func (s *Server) HandleUserStatus(w http.ResponseWriter, r *http.Request)

func (*Server) Init 

func (s *Server) Init() error

Init prepares the control plane without binding a listener: it bootstraps the signing keyring, discovers OIDC providers and starts the key-rotation loop. Embedders that own their own listener call Init + RegisterRoutes instead of Start.

func (*Server) RegisterRoutes 

func (s *Server) RegisterRoutes(mux *http.ServeMux)

RegisterRoutes registers every control-plane HTTP handler on mux.

func (*Server) SetMeshAdapter 

func (s *Server) SetMeshAdapter(m MeshAdapter)

SetMeshAdapter sets a custom MeshAdapter implementation for the control plane.

func (*Server) Start 

func (s *Server) Start() error

Start boots up HTTP services, sets up OIDC providers, loads initial keys and policies, and schedules rotations. Start boots up HTTP services, sets up OIDC providers, loads initial keys and policies, and schedules rotations.

type ServiceAnnouncement 

type ServiceAnnouncement struct {
	ServiceName string
	ServiceType string
	PeerID      string
	Addresses   []string
}

ServiceAnnouncement represents service discovery details retrieved from the mesh.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.