Use separate signing keys used for the cert and the token

[roehrich-hpe]

The key used to sign a cert and the key used to sign a token should have nothing to do with each other and they aren't even used in the same context. The following adjusts the code to allow distinct keys for certs and tokens.

[roehrich-hpe]

ping

[ajfloeder]

Remind me please... Given that these operations use the k8s server as a store, what is the granularity of these keys? 1 per job, 1 per compute node, some other? I'm asking to determine what sort of usage might stress the API servers and where in the workflow that occurs.

[roehrich-hpe]

Remind me please... Given that these operations use the k8s server as a store, what is the granularity of these keys? 1 per job, 1 per compute node, some other? I'm asking to determine what sort of usage might stress the API servers and where in the workflow that occurs.

Everything is stored in k8s Secrets.
The software on the compute side will no longer talk to the API server--each compute talks only to its matching rabbit. That rabbit will be running the copy-offload server as a user container.

The copy-offload server will read these secrets to get the TLS cert and the key for verifying the token. The server does this on startup, at PreRun, and keeps that info until it's shutdown at PostRun.

There is one TLS cert system-wide. There is one token+key per workflow.