Repository navigation

Draft: implement space-owned service-account lifecycle and runtime identity - #5520

Draft

rkoster wants to merge 57 commits into

cloudfoundry:mainfrom

rkoster:service-accounts-poc

Commits on Oct 5, 2026
- Test space-owned service accounts and same-space assignment (red)
  rkoster
  committed
  637c070
- Implement space-owned service accounts and same-space assignment
  rkoster
  committed
  928575b
- Test same-space app account relationship endpoint (red)
  rkoster
  committed
  1a66aa1
- Expose same-space app service account relationship
  rkoster
  committed
  34dd07a
- Test account client and OAuth principal provisioning (red)
  rkoster
  committed
  999a6cd
- Reconcile account clients and roleless OAuth principals
  rkoster
  committed
  3c9e1c7
- Test provisioning HTTP retries and altered TLS policies (red)
  rkoster
  committed
  fa49879
- Normalize managed client sets and reject extra TLS policies
  rkoster
  committed
  702fb37
- Test retryable account provisioning worker job (red)
  rkoster
  committed
  d465593
- Add credential-free retryable account provisioning job
  rkoster
  committed
  938c5cf
- Test configured provisioning client and token refresh (red)
  rkoster
  committed
  8bd6cb7
- Configure dedicated account provisioning client in workers
  rkoster
  committed
  9092f44
- Test asynchronous first-bind provisioning and job reuse (red)
  rkoster
  committed
  270ccf4
- Queue pollable provisioning on authorized first bind
  rkoster
  committed
  89673d7
- Test account listing description and metadata updates (red)
  rkoster
  committed
  4e64e51
- Add scoped account listing description and metadata APIs
  rkoster
  committed
  4453c3c
- Test account disable enable and safe deletion lifecycle (red)
  rkoster
  committed
  76bddca
- Reconcile account disable enable and unused-account deletion
  rkoster
  committed
  9d62b7b
- Test service account and assignment audit events (red)
  rkoster
  committed
  69b9638
- Audit service account lifecycle and assignment changes
  rkoster
  committed
  e3d62b8
- Test explicit account roles without human UAA lookup (red)
  rkoster
  committed
  3f59b0d
- Resolve managed account names locally for explicit role APIs
  rkoster
  committed
  b520f3a
- Test typed runtime identity and fail-closed account gates (red)
  rkoster
  committed
  b3fbf77
- Build typed ready-account runtime identity and discovery metadata
  rkoster
  committed
  7b491b0
- Test runtime and task account propagation boundaries (red)
  rkoster
  committed
  d1a07f4
- Propagate account identity to runtime recipes and discovery
  rkoster
  committed
  570e417
- Test task account identity snapshot at creation (red)
  rkoster
  committed
  527812f
- Snapshot task account identity before asynchronous submission
  rkoster
  committed
  6c56629
- Test process account launch snapshot on restart (red)
  rkoster
  committed
  820fc87
- Preserve process account launch identity until explicit restart
  rkoster
  committed
  6172393
- Test staging exclusion of injected account discovery (red)
  rkoster
  committed
  bbef6e4
- Exclude service account discovery from all staging inputs
  rkoster
  committed
  87b3b82
- Test active identity deletion and secretless discovery guards (red)
  rkoster
  committed
  c40ff32
- Protect active launch identities and non-secret endpoint discovery
  rkoster
  committed
  5b59bd4
- Verify pollable account provisioning retries through completion
  rkoster
  committed
  e4e4368
- Verify concurrent apps share one first-bind provisioning job
  rkoster
  committed
  30a7268
- Test provisioning validation for API local workers (red)
  rkoster
  committed
  7435e10
- Validate optional provisioning inputs for API local workers
  rkoster
  committed
  dc3d3a0
- Test pre-feature launches cannot acquire new account identity (red)
  rkoster
  committed
  b74c294
- Keep pre-feature launches account-free until explicit launch
  rkoster
  committed
  7c7c97b
- Test account app listing applies requested filters (red)
  rkoster
  committed
  b9fc5c1
- Apply normal app filters to account app listing
  rkoster
  committed
  b8d8187
- Test bind exclusion during retrying lifecycle operations (red)
  rkoster
  committed
  468201e
- Block binding during retrying disable or delete operations
  rkoster
  committed
  da5b96b
- Test owned account guard before recursive space deletion (red)
  rkoster
  committed
  2c9e34c
- Report owned service accounts before recursive space deletion
  rkoster
  committed
  a19c292
- Verify rebuilt LRPs preserve launch account after unbind
  rkoster
  committed
  aab9c77
- Document experimental space-owned service account API and rollout
  rkoster
  committed
  8af06c4
Commits on Oct 6, 2026
Commits on Oct 7, 2026

Commits

Commits on Oct 5, 2026

Commits on Oct 6, 2026

Commits on Oct 7, 2026