[mrunalp]

Summary

Draft RFC 0019 proposes splitting credential storage and token refresh out of the gateway into a credential issuer. The issuer can run embedded (the default) or as a remote service on another cluster. The gateway keeps provider semantics, workspace authorization, and delivery to supervisors.

Related Issue

Refs #4358

This RFC covers the storage, refresh minting, and stale-credential reporting parts of #4358. Interactive OAuth login flows are listed as a non-goal and an open question, so this PR does not close the issue. The RFC number 0019 is provisional until maintainers assign one.

Changes

• Add rfc/0019-credential-issuer-service/README.md in draft state.
• Make the issuer the only store of secret values, including SSH host keys and shared supervisor launch material, in both modes. The gateway database keeps only non-secret state.
• Ship the issuer as a library crate that the gateway links by default, plus a service binary for remote mode. Both modes go through the same service handlers.
• Propose three contracts: CredentialStore (put, delete, and batch resolve with versions and cache TTL), CredentialRefresh (refresh grants), and TokenMinter (stateless plugins for custom refresh strategies).
• Replace refresh-time handle swaps on gateway provider records with issuer-owned credential references that carry versions. Include the versions in the provider environment revision.
• Have the gateway pull values and receive version-only change notifications from the issuer.
• Require mTLS from the gateway to a remote issuer, with certificate-file or SPIFFE X.509-SVID client identity. The issuer binds each reference to the gateway that created it and scopes each gateway to its allowed workspaces.

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass (mise run markdown:lint: Markdown and Mermaid lint)
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

The local pre-commit hook was skipped for this commit. Its Rust lockfile check fails locally because of an sccache error, on lockfiles this PR does not change.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

RFC numbering heads-up: this RFC currently uses 0019, which is already taken by the repository migration RFC (#4426). 0020 (#4564) and 0021 (#4721) are also in use, and 0022 has just been assigned to #5200. This RFC should probably use 0023, which means renaming the folder to rfc/0023-credential-issuer-service/ and updating the title. The number can also be recorded on #4358.