The signature verification process can follow two different paths based on how the agent was deployed.
By default, the agent will wait for a valid request from a Portainer instance and automatically associate the first Portainer instance that communicates with it by registering the public key found in the
X-PortainerAgent-PublicKeyheader inside memory.
During the association process, the agent will first decode the specified public key from hexadecimal and then parse the public key. Only if these steps are successfull then the key will be associated to the agent.
Once a Portainer instance is registered by the agent, the agent will not try to decode/parse the public key associated to a request anymore and will assume that only signatures associated to this public key are authorized (preventing any other Portainer instance to communicate with this agent).
Finally, the agent uses the associated public key and a default message that is known by both entities to verify the signature available in the
Where is the public key of associated Portainer instance saved on agent container ?
Shouldn’t that key be stored in persistent volume to prevent opening agent to unauthorized Portainer instances after restart/rebuild of agent container ?