DL-545
A Runner-cluster entry whose issuer serves no anonymous discovery uses a jwksFile rendered from the cluster’s public keys, so no Go change is needed; the rendered Runner gets serverCA, an optional serverName that sets the Runner’s TLS server name through –server-name so a certificate naming only the public host verifies against the in-cluster serverAddr, and an egressAllow list rendered as –egress-allow, and its node exposes KVM as the kvmResourceName extended resource, stages the seccompProfilePath profile, and supports hostUsers: false; the Runner’s microVM volume root is the volumes subdirectory of the session-volume hostPath mount, and the operator puts the project quota on that subdirectory, never on the hostPath itself, so the quota check has an unprojected reference above it.
Status: Active (Matt, 2026-10-17)