Skip to content

Daemon pre-launch reliability + data-plane trust gate (default-off) + PII redaction #417

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TeoSlayer merged 2 commits into from
Jul 23, 2026
Merged

Daemon pre-launch reliability + data-plane trust gate (default-off) + PII redaction #417

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2660e2c
daemon: pre-launch reliability + data-plane trust gate (default-off) …
teovl Jul 23, 2026
f130491
daemon: wire --strict-dataplane-trust / PILOT_STRICT_DATAPLANE_TRUST …
teovl Jul 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions cmd/daemon/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ func main() {
rekeyWhitelist := flag.String("rekey-whitelist", "", "PILOT-345: comma-separated trusted peer node IDs that bypass the tunnel-rekey interval and 4096 cap. Env: PILOT_REKEY_WHITELIST.")
timeWait := flag.Duration("time-wait", 0, "TIME_WAIT duration (default 10s)")
public := flag.Bool("public", false, "make this node's endpoint publicly visible (default: private)")
strictDataplaneTrust := flag.Bool("strict-dataplane-trust", false, "WS1: refuse key-exchange/control-plane interaction with untrusted peers on a private node. Default false (not enforcing, wire-compatible with old agents). Env: PILOT_STRICT_DATAPLANE_TRUST=1.")
relayOnly := flag.Bool("relay-only", false, "hide real_addr from peers; reach this node only via beacon-relay path. Privacy stance: peers cannot enumerate this daemon's public IP. Trade-off: relay adds one beacon hop. Default false (current direct-first behavior).")
hostname := flag.String("hostname", "", "hostname for discovery (lowercase alphanumeric + hyphens, max 63 chars)")
noEcho := flag.Bool("no-echo", false, "disable built-in echo service (port 7)")
Expand Down Expand Up @@ -239,6 +240,7 @@ func main() {
MaxTotalConnections: *maxConnsTotal,
TimeWaitDuration: *timeWait,
Public: *public,
StrictDataPlaneTrust: *strictDataplaneTrust || os.Getenv("PILOT_STRICT_DATAPLANE_TRUST") == "1",
RelayOnly: *relayOnly,
Hostname: *hostname,
DisableEcho: *noEcho,
Expand Down
6 changes: 3 additions & 3 deletions pkg/daemon/beacon_discovery.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ func initialJitter() time.Duration {
// (We don't run this on every tick — only at first-tick to keep the
// hot path simple.)
func (d *Daemon) beaconRefreshLoop() {
if d.beaconSelection == nil || d.regConn == nil || d.identity == nil {
if d.beaconSelection == nil || d.reg() == nil || d.identity == nil {
// Nothing to refresh — single-beacon static config without
// identity/registry. Exit cleanly.
return
Expand Down Expand Up @@ -152,14 +152,14 @@ func (d *Daemon) beaconRefreshTick(firstTick bool) {
// equal to interface nil, so fetchBeaconList's `client == nil`
// guard wouldn't catch it — and (*Client).Send panics on a nil
// receiver. Bail early from this tick if no registry connection.
if d.regConn == nil {
if d.reg() == nil {
if firstTick {
slog.Debug("beacon discovery skipped (no registry connection)")
}
return
}

discovered, err := fetchBeaconList(d.regConn)
discovered, err := fetchBeaconList(d.reg())
if err != nil {
// On the FIRST tick, try the on-disk cache as a fallback —
// the registry may have been briefly unreachable at startup.
Expand Down
Loading
Loading