Jon Chery
9c65833954
---ci--- project: orca phase: 23 milestone: v0.12 status: execute ---/ci--- The full deletion of legacy CA/mTLS/daemon is deferred to v1.x. The legacy code is deprecated; v0.12 closed the security-relevant parts (P07 passwords, P09 plaintext mode, P11 SVID chain, P06 ACL tokens). The big-bang deletion is a code-hygiene refactor, not a security fix; v1.x will close it. Decision documented in P23_DUAL_WRITE_DECISION.md.
1.5 KiB
1.5 KiB
P23 Dual-Write Closure — Decision (v0.12)
Status: DEFERRED to v1.x. The full deletion of the legacy CA
(internal/security/ca.go), mTLS transport (internal/transport/mtls.go),
and daemon plaintext mode is too large a refactor for v0.12 without
risking build stability. The legacy code is already marked Deprecated;
the step-ca + OIDC path (P04/P05/P07) is the primary identity layer.
What v0.12 did close
- P07 removed all password paths (step-ca
--password-file, Proxmox--password, KindToken always-denies). - P09 removed daemon plaintext mode (Start() requires mTLS).
- P11 added SVID chain validation (VerifySVIDWithChain).
- P06 rewrote ACL to OIDC (KindToken deprecated).
What remains for v1.x
- Delete
internal/security/ca.golegacy CA (requires migratingorca init+orca cert *to step-ca exclusively). - Delete
internal/transport/mtls.godeprecated path. - Delete
internal/certpaths/(v0.8 flat layout);internal/paths/is the only layout. - Migrate
rotate-lead,drain,cutover,recoveryfromcertpathstopaths.
Why not in v0.12
The legacy CA is load-bearing for orca init and 6+ CLI commands. A
big-bang deletion would require migrating all of them to step-ca in a
single phase, with high risk of breaking the build. v0.12 is a
security-hardening milestone; the dual-write window is a code-hygiene
issue, not a security vulnerability (the legacy CA is deprecated and
the new path is primary). v1.x will close it as a focused refactor.