Ilker ManapandClaude Opus 5.5
a9ca326dd2
Rack controllers ask the region for a server certificate for their own URL's host (POST /api/v1/rack/server-cert; CN rack-server:NAME, ServerAuth only, never one of the region's names or addresses) and serve the agents' endpoints and images over HTTPS too (tls_listen, default <host>:443), reporting the HTTPS URL when they register (accepted only on the rack's own host). The pxelinux command lines name it with the CA fingerprint (rollcall.tls=, rollcall.ca=); the embedded rack uses the region's listener. Agents fetch /ca.pem, accept it only by that fingerprint and then use HTTPS with it, including the image download; a job fetched over HTTPS gets an HTTPS image URL. No fallback to HTTP once TLS was asked for; old agents ignore the new words. The CLI refuses a rack controller's certificate as the region. PXE itself (TFTP, kernel, initrd) stays unauthenticated: this protects what agents send and receive from listeners and from an HTTP server posing as the rack, not from an attacker rewriting boot files. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>