EnrollmentService
This page lists the methods of EnrollmentService in kibotos.enrollment.v1 with the messages and enums each one uses, generated from enrollment.proto and its comments.
EnrollmentService is mounted on both the Operator API and the node API. The transport principal decides what a caller may do: a bootstrap principal (spiffe://<trust-domain>/enrollment/<grant-id>) may only call Enroll, and a formal Operator or node principal may only call Renew. The router enforces that rule before it deserializes any request body, and Enroll additionally requires the grant kind to match the endpoint it arrived on.
Enroll
/kibotos.enrollment.v1.EnrollmentService/EnrollUnaryEnrollRequestEnrollRequest proves possession of a client-generated key. The CSR must be a DER PKCS#10 request of at most 8 KiB without requested extensions or names; ctrl ignores its subject and builds the identity from the grant.
EnrollResponseRenew
/kibotos.enrollment.v1.EnrollmentService/RenewUnaryRenewRequestRenewRequest carries a CSR for a fresh client-generated key. ctrl issues only for the same active principal that authenticated the call.
RenewResponseMessages and enums
Several methods of EnrollmentService use these messages and enums.
IssuedIdentity
IssuedIdentity is the authoritative result of one enrollment or renewal. It never carries a private key.
certificate is the DER leaf signed by the control-client CA.
ca_certificate is the DER control-client CA so the client can verify the chain before persisting anything.
kibotos.operator.v1 types
This page lists the messages and enums of kibotos.operator.v1 that no single service owns, generated from operator.proto and its comments. Those that one service uses are on that service's page.
/v1/files
This page describes /v1/files on the node data plane. Its parameter names and limits are generated from the constants the Kibotos code implements it with.