The endorsement DSL provides a concise, human-readable syntax for expressing endorsements in Intermesh.
<endorser> endorses <targets> as <claims>
- endorser: The IMID making the endorsement
- targets: Comma-separated IMIDs, names, or patterns being endorsed
- claims: Comma-separated names, IPs, or constraints being asserted
Semicolons (;) separate multiple endorsements. Hash (#) starts comments.
Keywords:
any- Wildcard target (only valid inside constraints, setsany_target=true)
# Single name and IP claim
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses BmN8fT2pK6qX3wZ9rH4cL7vY1dE5sG2jP0nF8tW4hQ6a1 as database.local, 192.168.1.10
# Multiple claims for one target
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses CpQ7gY3tM8vW2nF6kH9dL4zR1xE5sT7jN0bP8mK2fV3c1 as api.myapp, 192.168.1.1, 2001:db8::1
# Multiple endorsements
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses BmN8fT2pK6qX3wZ9rH4cL7vY1dE5sG2jP0nF8tW4hQ6a1 as web1.myapp, 192.168.1.1;
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses CpQ7gY3tM8vW2nF6kH9dL4zR1xE5sT7jN0bP8mK2fV3c1 as web2.myapp, 192.168.1.2
# Endorse all nodes matching a pattern
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses *.worker.myapp as shared.db
# Pattern syntax:
# example.com - Exact match
# *.example.com - Single subdomain level
# **.example.com - Arbitrary subdomain depth
# ** - Matches anything
Constraints express trust policies by specifying which endorsers can make which claims:
# Allow specific IMID to endorse any target with any claim
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 as constraint(
BmN8fT2pK6qX3wZ9rH4cL7vY1dE5sG2jP0nF8tW4hQ6a1 endorses any as **, 0.0.0.0/0
)
# Pattern-based authority scoping
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 as constraint(
*.local endorses *.local as 10.0.0.0/8
)
# Multiple endorsers in one constraint
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 as constraint(
CpQ7gY3tM8vW2nF6kH9dL4zR1xE5sT7jN0bP8mK2fV3c1, BmN8fT2pK6qX3wZ9rH4cL7vY1dE5sG2jP0nF8tW4hQ6a1 endorses **.myapp as 192.168.0.0/16
)
# Cross-domain delegation
AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 endorses AkR3kVnR2c8HpzNQ7xJL4m2vB9FqW1xyT5PnM7R3kVnZ1 as constraint(
gateway.partner endorses **.partner as 203.0.113.0/24
)