Edge Cache and CDN Platform · View 27 of 29 · 7 · Assurance
Decisions
- A PoP holds no credential that can write to the control plane. It pulls signed bundles, reads its own keys and publishes acknowledgements on a subject it is only allowed to write to. A stolen PoP can serve its own cache and nothing else.
- Signed URLs and tokens are verified in Envoy before the cache is involved and stripped before the key is built. A forged token costs an attacker a 403, not a cache entry.
- Origins accept only mTLS from shield identities. An origin can refuse any request that did not come through the platform, so its public address stops being a way around the edge.
Three privileges, kept apart
- Changing configuration, purging and reading delivery logs are separate Keycloak roles held by separate groups. Purge is the privilege most likely to be abused, so wildcard purge also requires a second role and is limited to one per property per hour.
At rest
- NVMe caches are LUKS2 volumes with keys sealed to the TPM. Decommissioning or quarantining a PoP destroys the sealed keys, which makes the whole cache unreadable in seconds without wiping a drive.
