internal/authctl, api, docs: a system account's recovered revocation keeps the identity key across a signing key rotation #52

Merged

mikluko merged 4 commits from mikluko/octant/2393-sysaccount-revocations into main

2026-10-05 13:08:21 +00:00

mikluko commented

2026-10-05 13:02:31 +00:00

(Migrated from github.com)

A system account's revocations recovered from the servers on adoption now list its identity key as an issuer and survive a rotation of its signing keys (X2393).

The issuers existed only inside the NATS operator reconcile, which signs them into a JWT that has no issuers; SystemAccountReconciler rebuilt status.revocations from that JWT's signing keys. The NATS operator reconcile now records what it signed, with issuers, in NatsOperator.status.systemAccount.revocations (additive, v1beta1). The NatsSystemAccount builds its record from that first, and the next signing reads it ahead of the NatsSystemAccount's record. Order matters because accountRevocations keeps the first entry's issuers on a tie. Having the NATS operator reconcile write the NatsSystemAccount status instead was rejected because it puts two writers on one status.

Revocations the controller records itself keep the rotation reset.

Not covered: a system account adopted before this change keeps its recovered revocations without the identity key.

Story 14 also gets Q2395's paragraph on restarting from resolver_preload.

Fails on the old code: TestSystemAccountAdoption_SigningKeysRotated, and the issuer assertions in TestSystemAccountAdoption and story 14's fixture test.

A system account's revocations recovered from the servers on adoption now list its identity key as an issuer and survive a rotation of its signing keys (X2393). The issuers existed only inside the NATS operator reconcile, which signs them into a JWT that has no issuers; `SystemAccountReconciler` rebuilt `status.revocations` from that JWT's signing keys. The NATS operator reconcile now records what it signed, with issuers, in `NatsOperator.status.systemAccount.revocations` (additive, v1beta1). The `NatsSystemAccount` builds its record from that first, and the next signing reads it ahead of the `NatsSystemAccount`'s record. Order matters because `accountRevocations` keeps the first entry's issuers on a tie. Having the NATS operator reconcile write the `NatsSystemAccount` status instead was rejected because it puts two writers on one status. Revocations the controller records itself keep the rotation reset. Not covered: a system account adopted before this change keeps its recovered revocations without the identity key. Story 14 also gets Q2395's paragraph on restarting from `resolver_preload`. Fails on the old code: `TestSystemAccountAdoption_SigningKeysRotated`, and the issuer assertions in `TestSystemAccountAdoption` and story 14's fixture test.