Repository navigation
api-auth: drop the token lifetime cap; give the gateway a ten-year token - #1500
Merged
Merged
Conversation
kvinwang
changed the title
kvinwang
force-pushed
the
feat/permanent-gateway-agent-token
branch
from
October 29, 2026 04:53
fccb376 to
ecd62c1
Compare
The gateway's Health token only grants `guest:health`, and its expiry is judged by a guest clock the host controls, so a short lifetime bounds little. What it does add is a failure mode: if registration stalls for longer than the token's remaining life, every instance of the app fails its health poll and drops out of rotation at once. Stop capping `exp - iat` in the verifier: an issuer that holds a trusted key can already mint any scope, so how long its tokens live is its own call. dstack-util now signs the gateway's token with `iat` rounded down to the year and `exp` ten years later. Signed-off-by: Kevin Wang <wy721@qq.com>
kvinwang
changed the title
kvinwang
force-pushed
the
feat/permanent-gateway-agent-token
branch
from
October 29, 2026 04:54
ecd62c1 to
ef6671c
Compare
kvinwang
enabled auto-merge
October 29, 2026 15:47
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The gateway's token only grants
guest:health, and expiry is checked against a guest clock the host controls. A short lifetime therefore buys little, but it lets a registration outage longer than the token's remaining life pull every instance of an app out of rotation at once.exp - iat, for any issuer.expis still required and enforced; how long a token lives is the issuer's call.iatrounded down to the year andexpten years later, so it changes once a year and never lapses while registration is down.Follow-up to #1499.