Repository navigation
Resolve the bootstrap token to an identity of its own - #204
Merged
Merged
Conversation
The token resolves to an identity typed user, and that identity has no record in Users. It is therefore a member the Console cannot name, and it sits one plausible change away from being provisioned as a real account -- which would spend the one-shot first-admin claim at install time, before any operator has signed in. It resolves as IDENTITY_TYPE_PLATFORM now. Nothing downstream needs to accept it: services that require a user or a workload reject it through the default branches they already have. Registering it with the identity service is also retried until it lands rather than attempted once. That call is what grants the platform its cluster admin relation, and on a cold cluster the identity service is routinely not serving yet -- so a single attempt leaves the platform with no administrator of its own and nothing to correct it. Refs architecture/changes/2026-08-08-one-step-install.md
This was referenced Aug 9, 2026
Registering it at startup made this service responsible for a fact it does not own, and the retry loop that came with it was convergence inside a single run -- the shape this change set exists to remove. The identity service owns the record and the cluster admin relation and converges both from its own configuration. Nothing is left for the Gateway to do but compare the token and return the configured identity and type, which needs no client to the identity service at all. Refs architecture/changes/2026-08-08-one-step-install.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bootstrap token resolves to an identity typed
user, and that identity has no record in Users. It is therefore a member the Console cannot name, and it sits one plausible change away from being provisioned as a real account — which would spend the one-shot first-admin claim at install time, before any operator has signed in.It resolves as
IDENTITY_TYPE_PLATFORMnow (agynio/api#180). Nothing downstream needs to accept it: services that require a user or a workload reject it through the default branches they already have.This PR also removes what an earlier version of it added. Registering the identity from the Gateway at startup made this service responsible for a fact it does not own, and the retry loop that came with it was convergence inside a single run — the shape one-step-install exists to remove.
The identity service owns the record and the cluster admin relation and converges both from its own configuration (agynio/identity#19). Nothing is left for the Gateway to do but compare the token and return the configured identity and type — which needs no client to the identity service at all, so that client and its
IDENTITY_GRPC_TARGETconfig go too.Net: -40 lines, +10.