use reusalbe key for daemon

[kerthcet]

What this PR does / why we need it

Which issue(s) this PR fixes

Fixes #

Special notes for your reviewer

Does this PR introduce a user-facing change?

[Copilot]

Pull request overview

This PR changes the SandD “daemon” pre-auth key policy from single-use to reusable (while keeping it ephemeral) so a workload daemon can re-register and rejoin the mesh after transient disconnects that trigger headscale’s ephemeral node reaping.

Changes:

• Update the keybroker daemon policy to mint reusable + ephemeral keys with a longer TTL (24h).
• Update tests and inline documentation to reflect the new daemon key semantics.
• Clarify test comments around per-workload key isolation (“freshly-minted credential”).

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pkg/sandd/keybroker.go	Updates MintDaemonKey documentation to describe reusable + ephemeral daemon keys.
pkg/sandd/keybroker_test.go	Updates test comment to match reusable + ephemeral daemon kind semantics.
pkg/provider/aws/sandd_test.go	Updates wording in test comment to avoid claiming daemon credentials are single-use.
cmd/keybroker/main.go	Changes daemon key policy to reusable + ephemeral with 24h expiration; expands rationale in comments.
cmd/keybroker/main_test.go	Updates policy/handler tests to assert daemon keys are reusable.

Suppressed comments (1)

cmd/keybroker/main.go:105

• In this file the controller key is described as having a “Long TTL (720h)” (and keyPolicy’s comment uses 720h as the example), but policyFor(kindController) currently returns expiration: "1h". Please reconcile the comment/docs and the actual controller expiration so readers aren’t misled about how long controller pre-auth keys stay valid.

		// Reusable so it can re-register across restarts; ephemeral so the old node
		// is reaped on disconnect, freeing the stable MagicDNS name for the fresh pod
		// to reclaim (the controller has no PVC, so nothing to preserve). Long TTL
		// (720h) just bounds a key that outlives a brief reap gap.
		return keyPolicy{reusable: true, ephemeral: true, expiration: "1h"}, true

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Suppressed comments (1)

cmd/keybroker/main.go:105

• The controller key policy comments (and config/sandd/README.md) describe a long TTL of 720h, but policyFor(kindController) currently sets expiration to "1h". This mismatch makes the controller key expire much sooner than intended, which could prevent re-registration after a reap/blip once the key expires.

	case kindController:
		// Reusable so it can re-register across restarts; ephemeral so the old node
		// is reaped on disconnect, freeing the stable MagicDNS name for the fresh pod
		// to reclaim (the controller has no PVC, so nothing to preserve). Long TTL
		// (720h) just bounds a key that outlives a brief reap gap.
		return keyPolicy{reusable: true, ephemeral: true, expiration: "1h"}, true

[kerthcet]

/lgtm
/kind bug

[InftyAI-Agent]

Approved: PR has both lgtm and approved labels

[InftyAI-Agent]

Approved: PR has both lgtm and approved labels