external

External application controller: an application controller type, version 1. A controller of this type is written under controllers.application with type: external.

Its connectivity test identifies the system it reaches by what the service’s test action reports, so that a second controller for the same system is warned of.

Connection

In the controller’s connection:

• url (string, required): the service’s address, https://host:port: qfence calls /v1/manifest and /v1/actions/{action} under it
• server_certificate_sha256 (string): the SHA-256 fingerprint of the certificate the service presents, pinned at registration: the connectivity test shows it until it is set
• next_server_certificate_sha256 (string): the SHA-256 fingerprint of the certificate that will replace the pinned one, trusted as it is: pin it before the service changes certificates, so the change leaves no gap
• timeout (duration, default 10s): the longest one call may take; a fence’s own timeout can only shorten it
• max_concurrent_calls (int, default 4): calls in flight at once; more wait within their deadline

Auth methods

The controller’s auth.method is one of these. A field marked secret comes only from the secret auth.credentials_ref names; the others are set in auth.config, or in that secret.

mtls

The client certificate and key qfence presents to the service: no other secret is ever sent to it (ADR 0005 §4).

• tls_cert (pem, required, secret)
• tls_key (pem, required, secret)

Addresses

Every address the type contacts. A secret’s scope (-scope-host) is checked against each that receives credentials.

• connection.url (port url, receives credentials): the controller’s service, which authenticates qfence by its client certificate