atunnel: broker actor certificates through atelet

[Eitan Yarmush (EItanya)]

Closes #706

Summary

• broker short-lived actor certificates from atelet over a same-node mTLS Unix socket
• keep the actor private key in atunnel and renew the certificate before expiry
• authenticate egress CONNECT using the actor certificate instead of bearer tokens

Testing

• make verify
• go test -race ./internal/atunnel

[Lior Lieberman (LiorLieberman)]

Thanks Eitan Yarmush (@EItanya) !

Quick question before I review more deeply today.

With the goal of "having a JWT available to atunnel to append on a CONNECT request to the egress" -- What parts of the this PR addresses?

Here are the parts we needed (before this pr -- havent reviewed it yet);

1. Improve the JWT issuance flow as part of MintJWT (properly authorize atelets, having the JWT formats solid, etc)
2. Implement an in-memory cache with go background routine that refreshes certs for every active actor.
3. Implement the UDS socket between atunnel and atelet to pass the certs+jwts.

From a very brief glance - I think your PR is attempting to do all three. Is that correct?

Also, For (1), we likely need to sort out two things to make the JWTs useful:

• Get the issuer a publicly accessible DNS name that is also oidc-compliant (cc: Taahir Ahmed (@ahmedtd))
• Agree on the format for the Subject field on JWTs

See for ref -

substrate/cmd/ateapi/internal/actoridentity/actoridentity.go

Lines 135 to 138 in 3ed6aa0

	// TODO: This is currently API but it has to be a globally unique, oidc-compliant and accsible DNS name
	Issuer: "https://api.ate-system.svc",
	// TODO: this format is very likely going to change.
	Subject: fmt.Sprintf("atespaces:%s:actors:%s", req.GetAtespace(), req.GetActorName()),

[Eitan Yarmush (EItanya)]

Yes, with two clarifications: this PR renews JWTs, not actor certificates, and each worker has only one active actor.

1. JWT issuance/authorization: implemented. Atunnel authenticates to atelet over mTLS using the worker Pod identity. Atelet derives the worker UID from that certificate and resolves its current actor assignment; the request does not supply actor identity. Ateapi then independently revalidates the atelet’s node, worker assignment, actor UID, and permitted audience before minting. The JWT includes the actor UID/resource version and worker Pod UID.

2. In-memory renewal: implemented for the worker’s single active actor. Atunnel mints before activation, stores the JWT in memory, renews with roughly 10% lifetime remaining, retries until expiry, and fails closed for new tunnels after expiry. Deactivation clears the JWT and stops renewal.

3. UDS broker: implemented. The UDS carries only JWT requests/responses—not certificates. The Pod certificate is used to mutually authenticate the atunnel↔atelet connection, including verifying both are on the same node.

I agree the issuer and subject contracts remain unresolved. This PR intentionally retains the existing issuer/subject behavior and does not implement PEP verification yet. Before verification lands, we need a stable OIDC issuer with discovery/JWKS reachable by the PEP.