Vault PKI + SPIFFE/SPIRE Identity
HashiCorp Vault issues the platform’s certificate authority and secrets; every service holds a SPIRE-issued SPIFFE identity for mTLS.
- Vault manages the root CA, intermediate CA, and leaf certificates, plus joiner secrets, bootstrap tokens, and LXD join tokens.
- Every Gough service is issued a SPIFFE SVID by SPIRE and communicates with other services over mutual TLS using that identity — no long-lived static service credentials.
- Operator and API authentication is JWT/OIDC: api-manager is its own first-party OIDC issuer (ES256), and gough login uses an OIDC device-code flow with tokens stored in the OS keychain, never as CLI arguments or plaintext files.
- RBAC roles are operator, maintainer, and viewer.
- Every backend Helm chart runs rootless — runAsNonRoot, dropped Linux capabilities, read-only root filesystem — with one documented exception: worker-ipxe binds the privileged DHCP/TFTP ports via CAP_NET_BIND_SERVICE rather than root.