Draft: wire service-account provisioning and runtime gates

[rkoster]

Summary

Community RFC draft: cloudfoundry/community#1645.

Draft BOSH wiring for the service-account proposal and companion cloud_controller_ng implementation.

• Declare/render default-off cc.service_accounts.provisioning_enabled and runtime_enabled gates and non-secret token endpoint discovery.
• Render a dedicated management client ID/secret and instance-identity trust anchor only into enabled workers. API templates expose gates/discovery, not provisioning credentials.
• Supply runtime discovery to clock-driven reconciliation.
• Render required worker cc.service_accounts.identity_ca_ref (UAA trust bundle name). Inline identity_ca is no longer declared; rendering fails when provisioning is enabled without a reference.
• Render cc.service_accounts.creation_limit (default -1/unlimited), the rolling seven-day creation budget per non-admin principal across the foundation; admins, including admin automation, are exempt.
• Pin cloud_controller_ng to tested source bbf68fabf (f267b9ea), including trust bundle references, owned trust-drift reconciliation, creation budget and cascading space/org cleanup.
• Make copied application directories readable by the unprivileged runtime user; this fixes a concrete prestart failure from private archive-parent modes during lab builds.

Verification

• Committed RED/GREEN template cycles: worker e7231e01 → 84b18957; API bd7d8831 → 333cda02; clock ed47d221 → 7dbf40bb.
• Trust bundle reference template RED 5089b31e → GREEN 90d4e4bf, reference-only RED 6845b53a → GREEN 1178b267; 112 API/worker/clock template examples pass.
• Budget template RED fbd0c3ed → GREEN e2a5bce2; 110 API/worker/clock release-template examples passed.
• Built/uploaded/deployed timestamped lab releases with these templates. Initial CAPI lab release 0.0.0+dev.20261006063000, source 8a4e504ae, release head ca650014; activation deployment succeeded.
• Live two-app/task evidence and a native CLI interactive demo exercised first-bind provisioning, explicit roles, disable/enable and unbind/restart semantics.

Lab release 0.0.0+dev.20261016110000 (source bbf68fabf, release head f267b9ea) deployed with worker identity_ca_ref: diego-instance-identity: disable/enable, a newly provisioned account and cross-account rejection all validated with clients referencing the UAA trust bundle. Creation budget and cascade cleanup are deployed but not separately exercised in the lab.

Rollout and draft dependencies

Companion drafts: cloud_controller_ng #5520, BBS contract #168, Diego #1216, CLI #3875. UAA baseline: cloudfoundry/uaa#4076.

Provision a dedicated management client, and define the instance identity CA as a named UAA trust bundle (uaa.mtls.trust_bundles) referenced by identity_ca_ref, before enabling provisioning. The lab UAA needed clients.read, clients.write and clients.admin; namespace-restricted provisioning is still an upstream requirement. Use the application root CA when validating Diego leaf+intermediate chains.

Keep runtime gates off until all participating BBS/rep/cells support the typed account contract and enabled cell identity gate; automatic capability negotiation is not implemented. UAA currently emits cnf rather than the draft's bearer-without-cnf profile; feedback is tracked at cloudfoundry/uaa#4076 (review).

Accounts are intentionally space-owned/same-space-only in this revised proposal. This release wiring does not imply immediate credential revocation or complete RFC acceptance. The source pointer is to the companion draft branch and must be aligned with the eventual upstream merge revision.