[tkkhq]

Tracking

• Stacked on feat(auth): treat pg- delegated grants as project-bound #476 (K1)
• Related: Kong/volcano-hosting#3311 (C1), Kong/volcano-hosting#3312 (C2), Kong/volcano-hosting#3313 (C3). The Hosting side of this PR is C6 (data-plane invoke with a grant), built in Kong/volcano-hosting#3329
• Related: Kong/volcano-builder#518
• Design: docs/design/builder-app/designs/grant-acceptance.md §6 and §7 K2 in Kong/volcano-builder

Why

• volcano cloud functions invoke lists, reads or creates the reserved volcano-cli-data-plane service key (sk-) and invokes with it. Hosting refuses the service-key routes to a grant, so under a grant invoke can't work this way. A grant must invoke as itself, so no long-lived key is ever minted for it (R11, R12).

Summary

• add dataplane.Service.InvokeToken: a pg- grant invokes with itself; any other credential gets the reserved service key, as before
• wire cloud functions invoke to InvokeToken in internal/cmd/cloud/cloud.go
• matches C6's contract (Kong/volcano-hosting#3329): POST /functions/{functionId}/invoke with Authorization: Bearer pg-…; name resolution through the functions list is a grant read; 403 grant_permission_missing (exit 5) and 429 rate_limit_exceeded (exit 1) keep their codes
• storage object commands are left to Hosting: under a grant they reach GET …/service-keys, which Hosting refuses with 403 grant_route_not_allowed (exit 5)
• removed in review as not required by Hosting: a CLI-side refusal of the service key and of storage commands under a grant, and a change to the local-only FunctionInvokeToken path
• docs: one sentence under "Delegated grants" in authentication.md, now in docs(cli): document delegated grants, exit code 6 and VOLCANO_TOKEN_FD volcano-docs#190

Verification

• go build ./...
• make check (openapi-generated-check, release-workflow-check, lint with 0 issues, test)
• TestGrantInvokesWithTheGrantAndNoServiceKey runs cloud functions invoke --id … --json with the worker's environment against a recording server. It makes exactly one request, POST /functions/{id}/invoke with the grant, and no /service-keys call
• TestInvokeTokenUsesADelegatedGrantDirectly (no request at all), TestInvokeTokenUsesTheServiceKeyForOtherCredentials
• merged the updated feat(auth): treat pg- delegated grants as project-bound #476 (main at 96438255)

[Copilot]

🟢 Approval recommended

The review reports no active issues requiring changes.

No open issues 🎉

What changed in this PR

Enables volcano cloud functions invoke to authenticate directly with delegated grants, building on project-bound grant support without creating a long-lived service key.

Changes:

• Adds grant-aware invoke token selection while preserving service-key behavior for other credentials.
• Wires cloud function invocation to the new token provider.
• Adds unit and command-level tests and documents the grant behavior.

File	Description
internal/​dataplane/​service_key.go	Adds InvokeToken to use delegated grants directly.
internal/​dataplane/​service_key_test.go	Tests grant passthrough and service-key fallback.
internal/​cmd/​cloud/​cloud.go	Connects cloud function invocation to InvokeToken.
docs/​authentication.md	Documents invocation without creating a service key.
cmd/​volcano/​grant_test.go	Verifies invocation sends the grant with no service-key requests.

_{Review effort: Balanced}