Mandrel Gantry

The Mandrel Gantry is the operational backbone of the mesh, responsible for Agent Lifecycle Management. It ensures that the governance policies defined in the Mandrel Spec are seamlessly integrated into the underlying compute infrastructure.

In a production environment, the Gantry role is performed by a Kubernetes Operator that automates the deployment, identity provisioning, and monitoring of agent workloads.

While the Mandrel project specifies the standard interfaces (such as the MandrelPlatformConfig CRD) required for this role, our Managed Service Provider (MSP) implementation provides the high-assurance, zero-touch automation required to run agentic systems at enterprise scale.

Lifecycle Features

The Gantry capability encompasses several critical operational responsibilities:

MandrelPlatformConfig CRD

MandrelPlatformConfig is a namespaced Custom Resource that the Collet reads at startup to resolve its governance authority endpoints and signing key material. One instance per namespace is the typical deployment pattern.

apiVersion: mandrelproject.ai/v1
kind: MandrelPlatformConfig
metadata:
  name: default
  namespace: mandrel-system
spec:
  metrologyLab:
    url: "https://lab.mandrel.internal:8740"
    jwksEndpoint: "/v1/identity/jwks"   # primary key discovery mechanism
    signingKeys:                         # optional; offline fallback for air-gapped envs
      - keyId: "a1b2c3d4"
        secretRef:
          name: "lab-signing-key-current"
          key: "public.pem"
    tlsCACert:                           # optional; absent = system trust store
      name: "lab-tls-ca"
      key: "ca.crt"

jwksEndpoint

The primary mechanism for the Collet to obtain the Lab’s active signing keys. By default, the Collet appends this path to the url defined above. The endpoint must serve an OKP/Ed25519 JSON Web Key Set (JWKS).

signingKeys (Offline Fallback)

An optional array of {keyId, secretRef} entries providing signing key material for air-gapped or high-security environments where the Collet cannot reach the jwksEndpoint. Each keyId must match the kid claim in JWS headers.

Rotation procedure (via JWKS): Key rotation is handled automatically by the Metrology Lab. The Collet periodically refreshes the JWKS; new keys are added and old keys are removed after a grace period. No MandrelPlatformConfig update is required for standard rotation.

Collet pull API

The Gantry publishes a pkg/platformconfig package that the Collet imports to load and watch the CRD:

The Collet builds a KeyStore (kid → ed25519.PublicKey) from the active JWKS endpoint, falling back to the resolved signingKeys only when the endpoint is unreachable. This is used to verify Realized Spec signatures.

Collet loader selection at startup:

• KUBERNETES_SERVICE_HOST set → NewK8sLoader("default", <pod-namespace>)
• --platform-config-file flag set → NewFileLoader(path)
• Neither → no-op loader (open-source / unsigned mode, startup warning emitted)

RBAC

The Collet’s ServiceAccount requires read access to MandrelPlatformConfig and the Secrets it references in its namespace (for offline fallbacks). A static manifest is provided for MVP; the full operator generates this automatically via sidecar injection.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: collet-platform-config-reader
  namespace: mandrel-system
rules:
  - apiGroups: ["mandrelproject.ai"]
    resources: ["mandrelplatformconfigs"]
    verbs: ["get", "watch", "list"]
  - apiGroups: [""]
    resources: ["secrets"]
    verbs: ["get", "watch", "list"]

Relationship to Other Components