Skip to content
TrustPlane

Control-signed bundles

When TrustPlane Control signs your trust material and policy bundles, the adapter can consume those signed files directly — while every allow/deny decision stays local. Auth verifies the mounted files with the Control signing public key and does not depend on Control service availability for request-time decisions.

The current path is file-based. You publish or mount the reviewed signed files, then perform a controlled restart or rollout so the adapter reads them. This path does not add hot reload, polling, object storage distribution, direct Control pull, or managed rollout execution.

Use the right adapter image

Section titled “Use the right adapter image”

Use the public GHCR image published from Auth PR #64 for this path:

Field Value
Auth commit c8579bac89534361b407d8e7fe0ae8d3b7a499b5
Public adapter image ghcr.io/trustplane-dev/trustplane-auth-adapter:v0.2.2@sha256:9e66feae80dfcd5f33b77c4b20968ebb5efbf9d7eb216c2cef2e4df66129e356
Internal DOKS verification image digest sha256:0bfbe7ab39ca50794554f3a15587ca6f2c12792bb056bb6d5efbab869d935b17

Use digest-pinned adapter images for this path. Do not use mutable image tags.

Create the Kubernetes Secrets

Section titled “Create the Kubernetes Secrets”

The adapter chart references externally-created Kubernetes Secrets by name and key only. It does not create Secrets, and public docs should not include signed bundle payloads, private keys, Secret values, kubeconfigs, tokens, or signed request logs.

Secret name Required key Purpose
trustplane-control-trust-material trust-material.signed.json Signed trust-material file
trustplane-control-policy-bundle policy-bundle.signed.json Signed policy-bundle file
trustplane-control-signing-public-key control-signing-public-key Control signing public key

Enable the Helm values

Section titled “Enable the Helm values”

Enable the mounted-file consume path with controlBundles.enabled=true:

controlBundles:
  enabled: true
  trustMaterialSecretName: trustplane-control-trust-material
  trustMaterialSecretKey: trust-material.signed.json
  policyBundleSecretName: trustplane-control-policy-bundle
  policyBundleSecretKey: policy-bundle.signed.json
  signingPublicKeySecretName: trustplane-control-signing-public-key
  signingPublicKeySecretKey: control-signing-public-key
  mountPath: /var/run/trustplane/control-bundles

When enabled, the adapter reads:

--bundle /var/run/trustplane/control-bundles/trust-material.signed.json
--policy-bundle /var/run/trustplane/control-bundles/policy-bundle.signed.json
--control-signing-public-key $(CONTROL_SIGNING_PUBLIC_KEY)

The adapter continues to make local verification decisions from the mounted files. Control can be unavailable during request-time verification; the adapter does not call Control synchronously.

Review the verification evidence

Section titled “Review the verification evidence”

This path is verified end-to-end on an internal DOKS deployment, with Auth PR #64 and auth-deploy PR #32 merged. The deploy workflow run records the passing verification.

Recorded verification outcome:

Check Result
Allowed request 200
Denied request 403
Public Ingress none created
Deployed image digest matched the internal DOKS verification image digest above

This evidence covers the mounted signed-file consume path only. Hot reload, polling, object storage distribution, direct Control pull, and managed rollout execution are not currently supported.

Next steps

Section titled “Next steps”