josh/electric-cherry
1
0
Fork 0
Code Issues 18 Pull Requests Actions Packages Projects Releases Wiki Activity

Require administrator-requested host credential rotation (Refs #97)
CI / checks (push) Successful in 5m24s
Details

Browse Source
This commit is contained in:
josh
2026-10-12 19:13:29 -04:00
parent 272055a1ed
commit 1b908f891f
5 changed files with 162 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guides/native-hosts.md
+9 -5
View File
@@ -513,11 +513,15 @@ access to operator pages. Game telemetry uses a separate `EC_TELEMETRY_TOKEN`,
configured in each reporter's authorization header; see the
[telemetry contract](beta-test-plans.md#game-reporter-protocol).
Hosts offers credential rotation and revocation. Rotation persists the new secret
on the agent before switching controller credentials, so a lost response can be
retried using the same proposed secret. Revocation affects one host only and does
not stop its running game containers. Re-enrollment requires a fresh token and an
explicit installer `--reenroll` when local credentials already exist.
Hosts offers credential rotation and revocation. Replacing a credential requires
an open administrator-requested rotation operation for that host. The controller
replaces the credential and completes that operation in one transaction. Rotation
persists the new secret on the agent before switching controller credentials, so
a lost response can be retried using the same proposed secret. A retry of the
active secret only acknowledges it; it cannot authorize another replacement.
Revocation affects one host only and does not stop its running game containers.
Re-enrollment requires a fresh token and an explicit installer `--reenroll` when
local credentials already exist.
## Host and game-file API