Skip to content

Add service identity self-enrollment RPCs to ZitiManagementService #49

@rowan-stein

Description

@rowan-stein

User Request

Add RequestServiceIdentity and ExtendIdentityLease RPCs to the ZitiManagementService proto. These RPCs support the service identity self-enrollment pattern described in the architecture docs, where infrastructure services (Gateway, Orchestrator, Runner) obtain ephemeral OpenZiti identities at runtime.

Specification

Changes to proto/agynio/api/ziti_management/v1/ziti_management.proto

New enum: ServiceType

Identifies which infrastructure service is requesting an identity. Used for role attribute assignment and lease tracking.

enum ServiceType {
  SERVICE_TYPE_UNSPECIFIED = 0;
  SERVICE_TYPE_GATEWAY = 1;
  SERVICE_TYPE_ORCHESTRATOR = 2;
  SERVICE_TYPE_RUNNER = 3;
}

New RPCs

Add to the existing ZitiManagementService:

// Infrastructure services (Gateway, Orchestrator, Runner) → request an enrolled
// OpenZiti identity for the calling service. Ziti Management creates the identity
// on the Controller, enrolls it (generates key pair, submits CSR, receives cert),
// and returns the enrolled identity to the caller.
rpc RequestServiceIdentity(RequestServiceIdentityRequest) returns (RequestServiceIdentityResponse);

// Infrastructure services → extend the lease on a service identity.
// Called periodically by the service to prevent GC from deleting the identity.
rpc ExtendIdentityLease(ExtendIdentityLeaseRequest) returns (ExtendIdentityLeaseResponse);

New messages

message RequestServiceIdentityRequest {
  // Which infrastructure service is requesting the identity.
  ServiceType service_type = 1;
}

message RequestServiceIdentityResponse {
  // The OpenZiti identity ID (for lease extension and cleanup).
  string ziti_identity_id = 1;
  // The full enrolled identity JSON (contains cert, key, CA, controller URL).
  // The caller writes this to ephemeral disk and loads it via the OpenZiti SDK.
  bytes identity_json = 2;
}

message ExtendIdentityLeaseRequest {
  // The OpenZiti identity ID whose lease should be extended.
  string ziti_identity_id = 1;
}

message ExtendIdentityLeaseResponse {}

Conventions

  • Follows existing proto style: snake_case fields, UPPER_SNAKE enum values with _UNSPECIFIED = 0
  • New enum uses SERVICE_TYPE_ prefix (not IDENTITY_TYPE_) to distinguish from the existing IdentityType enum which covers agent/runner/channel
  • identity_json is bytes (not string) because it contains an opaque JSON blob with embedded PEM data
  • No new file — all additions go into the existing ziti_management.proto

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions