Service Mesh Platform · View 09 of 31 · 3 · Structure
Decisions
- Each cluster intermediate carries an X.509 name constraint limiting it to its own trust domain (spiffe://c07.mesh.corp). A compromised cluster cannot mint a valid identity for another, even though every chain ends at the same root.
- SPIRE holds a 7-day signing CA in memory, renewed from OpenBao at half-life. OpenBao can be down for three days before issuance is affected.
- The trust bundle holds roots, never intermediates. Cluster intermediates can then be rotated, added or revoked without touching 40,000 bundles.
The coupled numbers
- A 24 h certificate renewed at 12 h means the fleet survives 12 h of total issuer outage with no degradation. That is the requirement's 12-hour control-plane figure, and it cannot be changed without changing the lifetime.
- Clock skew tolerance is ±60 s. Against a 24-hour lifetime the skew budget is negligible; against a 1-hour lifetime it would not be.
To prove
- That Envoy's TLS stack enforces URI name constraints on the chosen release. If it does not, per-cluster trust domains are still enforced by authorisation policy, but the cryptographic guarantee is lost.
