Terraform: generate and deliver the session-binding key to the backend pods - #41
Merged
Merged
Conversation
PR #39 binds caller-supplied AgentCore session ids to the authenticated tenant with an HMAC under PLATFORM_SESSION_BINDING_SECRET and falls back to deployment identifiers when it is unset. Generate the key in the portal module (random_password, same shape as origin_verify) and deliver it to the backend and entry pods through the chart's Secret via set_sensitive, so every replica binds identically and the value never appears in the rendered values. Document it next to the portal-admin secret, including that rotation ends continuity for open sessions. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
#39 keys the caller-binding of AgentCore session ids with
PLATFORM_SESSION_BINDING_SECRET, and falls back to deployment identifiers when it is unset. This gives the Terraform path a real key.random_password.session_bindingin the portal module, same shape asorigin_verify(rotation = taint the resource, then apply).backendandentryreleases through the chart's Kubernetes Secret viaset_sensitive, so every replica binds identically and the value never lands in the renderedvalues. The chart already supportssecretEnv(Keycloak and the team services use it).docs/deployment.md: a paragraph next to the portal-admin secret on what the key does, that nothing needs creating by hand, and that rotating it ends continuity for open Debug/channel conversations.Ordering
Merge after #39. Without #39 the env var is simply unread; with #39 and without this, the backend runs on the derived fallback key, which is fine for a laptop and not for a shared deployment.
Verified
terraform fmt -check,terraform validate, and aterraform planagainst the live stack:1 to add, 2 to change, 0 to destroy— the newrandom_password, and the two portal releases picking upset_sensitivealongside the image bump they were already getting.deploy-cli is not changed here; that path's backend values file has no
secretEnvyet and gets the fallback key. Follow-up.🤖 Generated with Claude Code