Repository navigation

feat(auth,sts,egress): task-scoped Biscuit attenuation, two-token STS, and egress brokers - #578

Merged

aojea merged 13 commits into

google:mainfrom

aojea:feat/sts-task-auth

Oct 6, 2026

Commits on Oct 6, 2026

Phase 1: remove sam-box, nano-init, and legacy agent identity machinery
aojea
committed
87956d5
feat(auth): implement Phase 2 TaskAuthorizationRule (tar_block) attenuation and cross-language verification
aojea
committed
fc46bb3
feat(sts): implement Phase 3 STS endpoints, OAuth 2.1, ext_authz, and revocations
aojea
committed
991957d
feat(egress,sdk): implement Phase 4 CloudTokenExchanger, inspection, TCP tunnels, sam-bench sts, and SDK attenuation
aojea
committed
476f328
docs: complete Phase 5 documentation overhaul for task-based authorization, STS, and egress brokers
aojea
committed
2c83993
feat(auth,node): add wildcard bindings, workload issuer containment, refresh re-attestation, and security architecture docs
aojea
committed
c9d55a7
fix(ci,sts,node): restore e2e runtime image and address review comments
aojea
committed
f2556bf
fix(node): enforce TAR service match in NarrowOIDCScopes and cache ext_proc HTTP clients
aojea
committed
8854674
test(node): add Envoy ext_authz and ext_proc integration and E2E datapath CUJs
aojea
committed
f8f8bbd
fix(node): fail closed in evaluateExtAuthz when target service is unresolved
aojea
committed
e27877a
Require PoP challenges on read/report endpoints and recover from clock skew via Date header
aojea
committed
5602e70
perf(controlplane): cache banned node revocation IDs and pre-parse static STS Datalog rules
aojea
committed
2f32f75
fix(identity,node): canonicalize Biscuit peer IDs, bound egress response buffering, and accept single AWS Statement
aojea
committed
eddd69a

Navigation Menu

Repository navigation

feat(auth,sts,egress): task-scoped Biscuit attenuation, two-token STS, and egress brokers - #578

feat(auth,sts,egress): task-scoped Biscuit attenuation, two-token STS, and egress brokers#578
aojea merged 13 commits into
google:mainfrom
aojea:feat/sts-task-auth

Commits on Oct 6, 2026

Phase 1: remove sam-box, nano-init, and legacy agent identity machinery

feat(auth): implement Phase 2 TaskAuthorizationRule (tar_block) attenuation and cross-language verification

feat(sts): implement Phase 3 STS endpoints, OAuth 2.1, ext_authz, and revocations

feat(egress,sdk): implement Phase 4 CloudTokenExchanger, inspection, TCP tunnels, sam-bench sts, and SDK attenuation

docs: complete Phase 5 documentation overhaul for task-based authorization, STS, and egress brokers

feat(auth,node): add wildcard bindings, workload issuer containment, refresh re-attestation, and security architecture docs

fix(ci,sts,node): restore e2e runtime image and address review comments

fix(node): enforce TAR service match in NarrowOIDCScopes and cache ext_proc HTTP clients

test(node): add Envoy ext_authz and ext_proc integration and E2E datapath CUJs

fix(node): fail closed in evaluateExtAuthz when target service is unresolved

Require PoP challenges on read/report endpoints and recover from clock skew via Date header

perf(controlplane): cache banned node revocation IDs and pre-parse static STS Datalog rules

fix(identity,node): canonicalize Biscuit peer IDs, bound egress response buffering, and accept single AWS Statement