Description
GCV-0013 enforces a composition-level token expiry ceiling, and today that ceiling covers the cloud StackServiceAccount and its rotating tokens. The in-stack side is not vended at all: oss serviceaccounts, serviceaccountrotatingtokens, serviceaccounttokens, serviceaccountpermissions and serviceaccountpermissionitems are all present in the pinned provider and none is emitted.
That means the ceiling covers roughly half the tokens a real platform hands out. A team that needs an in-stack service account for a Terraform run or a CI job creates one by hand today, outside the ceiling, outside the rotation policy and outside the decommission path - which is precisely the class of credential the machine exists to stop existing.
Acceptance Criteria
- #1 In-stack service accounts and their rotating tokens are vended from platform-controlled input, with an explicit external name on every deterministic child
- #2 The existing composition token expiry ceiling binds in-stack tokens exactly as it binds cloud tokens, and a request exceeding it is refused with its own message, proven against the real API server
- #3 Service account permissions have exactly one declarative owner, consistent with the whole-set resources rule, and that ownership is tested
- #4 No token value reaches status or a rendered example; only derived credentials are published, and a test proves it
- #5 Every emitted kind appears in the provider activation map and the XRD/renderer registry, and the gate fails by path if one is missing
Definition of Done
- #1 just check passes locally
- #2 hosted Validate workflow passes on the completing commit
Implementation Plan
Wave 6: implement the commissioned surface under the frozen goal and root-owned integration; prove admission and renderer boundaries with required negative controls, then just check and exact-SHA hosted Validate before finalization.
Final Summary
Vended in-stack service accounts, rotating credentials and one whole-set permission owner per stack. Deterministic names are explicit; provider-assigned account IDs are observed before dependents. Real API-server policy consumes the existing Composition maximumTokenLifetime and proves weaken/admit/restore. No credential values appear in XR status or examples. Completing source/pin SHA: 187b03ea40ee32fcea890e40c138f00a8c73bd5f. Hosted Validate run 34296536930: success. Local just check passed with 23 real API-server tests, zero skips.