Phases and lab runs
Roadmap and phase status
Phases
- Lab base (built 14 Oct 2026): the GCP VM, containerlab, SONiC switch hosts, and Talos with Secure Boot, swtpm and OVMF. The 802.1X gate also works end to end (T1, T2, T4, T5 partial, T19 partial, T51–T53 passed).
- Core (built 14 Oct 2026): offline root CA in SoftHSM with name-constrained intermediates, SPIRE in Core and Edge A with federation over NATS, NATS operator mode with per-customer accounts and the leaf on the switch host, Git and OCI registry, Cilium with no kube-proxy, the Go gate controller and the signed audit chain. T10, T11, T12, T30, T31 and T60 passed; T24, T39 and T40 passed partially; regressions T54–T60 (ADR-045 to ADR-050).
- Edge A: Sidero Labs KMS server, boot order, port gate (hostapd plus the controller), FDO, Keylime on the switch, and local Argo CD.
- Air-gap: update and export paths, TUF, the scan policy, time, and the tamper wipe.
- Edge B: a second customer trust domain, and isolation tests.
- Demo-ready: one-command rebuild, backups and restore, a Grafana dashboard, a scripted demo, and a NIS2 and IEC 62443 control mapping, with the Siemens UNS work described as a pilot.
Phase 3 status (14 Oct 2026)
- Built:
- The Sidero Labs KMS server on the Edge A switch host unlocks the Edge Talos EPHEMERAL volume. It has release conditions and an append-only, hash-chained log (ADR-051).
- Edge A is onboarded through maintenance mode, in the ADR-016 order.
- local-path storage for SPIRE (ADR-052).
- A local Argo CD at Edge A that pulls from Core Git (ADR-053).
- The KMS step in the one-action revocation.
- Deferred (ADR-054): SPIRE TPM attestation, TPM-backed device keys, Keylime, and our own Secure Boot keys (T6).
- Design rule: Cilium never runs on switch hosts (ADR-055).
- KMS binding (ADR-051, accepted for the POC): key release is tied to the node UUID and its pinned address. Two compensating controls cover the gap: TPM-backed 802.1X on the Talos infrastructure port (T68, needs our own image) and SPIRE TPM attestation for workload identity. Production requires TPM-bound KMS requests (RFE).
Lab run history
| Run (CEST) | Tests | Outcome |
|---|---|---|
| 14 Oct 2026, 18:48 CEST | 9 | Passed 6Partial 3 |
| 14 Oct 2026, 17:34 CEST | 29 | Passed 21Partial 5Failed 3 |
| 14 Oct 2026, 16:14 CEST | 28 | Passed 16Partial 4Failed 8 |
| 14 Oct 2026, 14:11 CEST | 22 | Passed 15Partial 6Planned 1 |
| 14 Oct 2026, 12:45 CEST | 7 | Passed 6Partial 1 |
Open items and end state
- End state (ADR-011): an Enterprise UNS in Core with ISA-95 subjects prefixed by customer, publishing over NATS to SPIRE-authorized edge nodes. There is also a kill switch: revoke federation, disable the NATS account, and stop Sidero Labs KMS server key releases, plus kicking the connection when a receiving host changes.
- Open items:
- check that the SPIRE TPM plugin re-checks boot state on renewal
- check that the SPIRE-Keylime plugin is mature enough
- the gNMI-to-NATS bridge
- 802.1X configuration on SONiC upstream (not available, so we use our own hostapd gate)
- compliance scope: NIS2 and IEC 62443 likely; NERC CIP probably out