Container Registry and Software Supply Chain Platform  ·  View 31 of 33  ·  6 · Assurance

Revocation Propagation

How a compromised builder stops being trusted, in minutes, without deleting anything.

Editable source SVG draw.io All views
Detect Compromise Report Log Monitor Rekor anomaly Revoke SPIRE Entry Removed Fulcio Identity Banned Robot Account Disabled Publish Revocation List signed · versioned Bundle Rebuild signer allowlist Distribute Control Topic push Bundle Poll ≤ 5 min Refresh Enforcement Points p95 ≤ 5 min Cache Invalidated p100 ≤ 15 min Effect Next Admission Denies nothing deleted Running Pods Continue eviction is separate Account Affected Artifact List by signer identity Rebuild Plan under a new identity drain when replaced Revocation — Invalidate Without Deleting Person or role Application we own Security / platform Data store Queue / topic Interface / broker Decision point Risk / gap failure / alternate The blast radius of a compromised builder is bounded by revocation, not by deletion. v 1.0 · owner Security Architecture · date 2026-09

Decisions

  • Revocation is an identity operation: the SPIRE entry is removed, the Fulcio identity is banned, the robot account is disabled
  • The signer allowlist is rebuilt into a new policy bundle, so revocation propagates by the same path as any policy change
  • Artifacts are not deleted; they simply stop satisfying policy

Targets

  • Revocation to full enforcement-point propagation p95 ≤ 5 minutes, p100 ≤ 15 minutes
  • Every affected artifact is enumerable by signer identity, which is why signer identity is a column and not a blob
  • The rebuild plan names what must be rebuilt under a new identity

The bounded blast radius

  • Running pods continue to run; revocation changes the next admission, not the current state of the cluster
  • Draining them is the same phase-3 mechanism as verdict-change eviction
  • Air-gapped sites propagate on the transport interval, not the 5-minute target — and deny on revocation-list age
◀  Key Management and Trust Roots All views Tenant Isolation  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises31-revocation-propagation