Tim Buckley 759203dc6a Add basic support for bound_keypair joining for standard agent types (#63962) ...

* Add basic support for `bound_keypair` joining for all agent types

This adds basic support for bound keypair joining for all agent
types. This provides benefits in certain situations, for example:
- Bound keypair registration secrets are single-use, unlike `token`.
  In rare cases, users may want to provide a credential that can only
  join one node.
- Bound keypair allows preregistration of the node's public key,
  eliminating shared secrets.

Notably, agents are still issued long-lived, effectively permanent
credentials (10yr) after their first registration. This means many
benefits of bound keypair joining are not relevant once joined;
agents should effectively never need to perform a recovery as their
primary credentials are valid for the life of the agent.

* Parse bound keypair params from file config

* Fix a few lints

* Properly pass registration secret to the join client

* Add first batch of tests

* Add test for makeJoinParams()

* Fix imports

* Write bound keypair credentials to the correct storage backend

* Only load the registration secret if no client state exists

* Explicitly raise an error if no registration secret is loaded when required

2026-04-09 23:56:39 +00:00

..

storage_test.go

Respect context in all process storage APIs (#63826)

2026-03-02 22:05:29 +00:00

storage_unix.go

Fix hostid collision in kube backend. (#57207)

2025-08-09 05:34:04 +00:00

storage_windows.go

fix: use Go 1.18+ build tag syntax (#53746)

2025-04-07 12:35:51 +00:00

storage.go

Add basic support for bound_keypair joining for standard agent types (#63962)

2026-04-09 23:56:39 +00:00