-
Notifications
You must be signed in to change notification settings - Fork 469
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #557 from enricoschiattarella/nodeattestor
K8s server and agent nodeattestor plugin
- Loading branch information
Showing
12 changed files
with
1,296 additions
and
10 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| # Agent plugin: NodeAttestor "k8s_sat" | ||
|
|
||
| *Must be used in conjunction with the server-side k8s_sat plugin* | ||
|
|
||
| The `k8s_sat` plugin attests nodes running in inside of Kubernetes. The agent | ||
| reads and provides the signed service account token to the server. It also | ||
| generates a one-time UUID that is also provided to the server. | ||
|
|
||
| The plugin generates SPIFFE IDs with the form: | ||
|
|
||
| ``` | ||
| spiffe://<trust domain>/spire/agent/k8s_sat/<cluster>/<UUID> | ||
| ``` | ||
|
|
||
| The main configuration accepts the following values: | ||
|
|
||
| | Configuration | Description | Default | | ||
| | --------------- | ----------- | ----------------------- | | ||
| | `cluster` | Name of the cluster. It must correspond to a cluster configured in the server plugin. | | ||
| | `token_path` | Path to the service account token on disk | "/run/secrets/kubernetes.io/serviceaccount/token" | | ||
|
|
||
| The token path defaults to the default location kubernetes uses to place the token and should not need to be overriden in most cases. | ||
|
|
||
| A sample configuration with the default token path: | ||
|
|
||
| ``` | ||
| NodeAttestor "k8s_sat" { | ||
| plugin_data { | ||
| cluster = "MyCluster" | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| ## Security Considerations | ||
|
|
||
| At this time, the service account token does not contain claims that could be | ||
| used to strongly identify the node/daemonset/pod running the agent. This means | ||
| that any container running in a whitelisted service account can masquerade as | ||
| an agent, giving it access to any identity the agent is capable of issuing. It | ||
| is **STRONGLY** recommended that agents run under a dedicated service account. | ||
|
|
||
| It should be noted that due to the fact that SPIRE can't positively | ||
| identify a node using this method, it is not possible to directly authorize | ||
| identities for a distinct node or sets of nodes. Instead, this must be | ||
| accomplished indirectly using a service account and deployment that | ||
| leverages node affinity or node selectors. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| # Server plugin: NodeAttestor "k8s_sat" | ||
|
|
||
| *Must be used in conjunction with the agent-side k8s_sat plugin* | ||
|
|
||
| The `k8s_sat` plugin attests nodes running in inside of Kubernetes. The server | ||
| validates the signed service account token provided by the agent. It extracts | ||
| the service account name and namespace from the token claims. The server uses a | ||
| one-time UUID provided by the agent to generate a SPIFFE ID with the form: | ||
|
|
||
| ``` | ||
| spiffe://<trust domain>/spire/agent/k8s_sat/<cluster>/<UUID> | ||
| ``` | ||
|
|
||
| The server does not need to be running in Kubernetes in order to perform node | ||
| attestation. In fact, the plugin can be configured to attest nodes running in | ||
| multiple clusters. | ||
|
|
||
| The main configuration accepts the following values: | ||
|
|
||
| | Configuration | Description | Default | | ||
| | --------------- | ----------- | ----------------------- | | ||
| | `clusters` | A map of clusters, keyed by an arbitrary ID, that are authorized for attestation. | | | ||
|
|
||
| Each cluster in the main configuration requires the following configuration: | ||
|
|
||
| | Configuration | Description | Default | | ||
| | ------------- | ----------- | ----------------------- | | ||
| | `service_account_key_file` | Path on disk to a PEM encoded file containing public keys used in validating tokens for that cluster. RSA and ECDSA keys are supported. For RSA, X509 certificates, PKCS1, and PKIX encoded public keys are accepted. For ECDSA, X509 certificates, and PKIX encoded public keys are accepted. | | | ||
| | `service_account_whitelist` | A list of service account names, qualified by namespace (for example, "default:blog" or "production:web") to allow for node attestation. Attestation will be rejected for tokens bound to service accounts that aren't in the whitelist. | | | ||
|
|
||
| A sample configuration: | ||
|
|
||
| ``` | ||
| NodeAttestor "k8s_sat" { | ||
| plugin_data { | ||
| clusters = { | ||
| "MyCluster" = { | ||
| service_account_key_file = "/path/to/key/file" | ||
| service_account_whitelist = ["production:spire-agent"] | ||
| } | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| In addition, this plugin generates the following selectors: | ||
|
|
||
| | Selector | Example | Description | | ||
| | -------------------| ------------------------------ | ------------------------------------------ | | ||
| | `k8s_sat:cluster` | `k8s_sat:cluster:MyCluster` | Name of the cluster (from the plugin config) used to verify the token signature | | ||
| | `k8s_sat:agent_ns` | `k8s_sat:agent_ns:production` | Namespace that the agent is running under | | ||
| | `k8s_sat:agent_sa` | `k8s_sat:agent_sa:spire-agent` | Service Account the agent is running under | | ||
|
|
||
| ## Security Considerations | ||
|
|
||
| At this time, the service account token does not contain claims that could be | ||
| used to strongly identify the node/daemonset/pod running the agent. This means | ||
| that any container running in a whitelisted service account can masquerade as | ||
| an agent, giving it access to any identity the agent is capable of issuing. It | ||
| is **STRONGLY** recommended that agents run under a dedicated service account. | ||
|
|
||
| It should be noted that due to the fact that SPIRE can't positively | ||
| identify a node using this method, it is not possible to directly authorize | ||
| identities for a distinct node or sets of nodes. Instead, this must be | ||
| accomplished indirectly using a service account and deployment that | ||
| leverages node affinity or node selectors. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,146 @@ | ||
| package k8s | ||
|
|
||
| import ( | ||
| "context" | ||
| "encoding/json" | ||
| "io/ioutil" | ||
| "sync" | ||
|
|
||
| "github.com/hashicorp/hcl" | ||
| uuid "github.com/satori/go.uuid" | ||
| "github.com/spiffe/spire/pkg/common/plugin/k8s" | ||
| "github.com/spiffe/spire/proto/agent/nodeattestor" | ||
| "github.com/spiffe/spire/proto/common" | ||
| spi "github.com/spiffe/spire/proto/common/plugin" | ||
| "github.com/zeebo/errs" | ||
| ) | ||
|
|
||
| const ( | ||
| pluginName = "k8s_sat" | ||
|
|
||
| defaultTokenPath = "/run/secrets/kubernetes.io/serviceaccount/token" | ||
| ) | ||
|
|
||
| var ( | ||
| satError = errs.Class("k8s-sat") | ||
| ) | ||
|
|
||
| type SATAttestorConfig struct { | ||
| Cluster string `hcl:"cluster"` | ||
| TokenPath string `hcl:"token_path"` | ||
| } | ||
|
|
||
| type satAttestorConfig struct { | ||
| trustDomain string | ||
| cluster string | ||
| tokenPath string | ||
| } | ||
|
|
||
| type SATAttestorPlugin struct { | ||
| mu sync.RWMutex | ||
| config *satAttestorConfig | ||
|
|
||
| hooks struct { | ||
| newUUID func() string | ||
| } | ||
| } | ||
|
|
||
| var _ nodeattestor.Plugin = (*SATAttestorPlugin)(nil) | ||
|
|
||
| func NewSATAttestorPlugin() *SATAttestorPlugin { | ||
| p := &SATAttestorPlugin{} | ||
| p.hooks.newUUID = func() string { | ||
| return uuid.NewV4().String() | ||
| } | ||
| return p | ||
| } | ||
|
|
||
| func (p *SATAttestorPlugin) FetchAttestationData(stream nodeattestor.FetchAttestationData_PluginStream) error { | ||
| config, err := p.getConfig() | ||
| if err != nil { | ||
| return err | ||
| } | ||
|
|
||
| uuid := p.hooks.newUUID() | ||
|
|
||
| token, err := loadTokenFromFile(config.tokenPath) | ||
| if err != nil { | ||
| return satError.New("unable to load token from %s: %v", config.tokenPath, err) | ||
| } | ||
|
|
||
| data, err := json.Marshal(k8s.SATAttestationData{ | ||
| Cluster: config.cluster, | ||
| UUID: uuid, | ||
| Token: token, | ||
| }) | ||
| if err != nil { | ||
| return satError.Wrap(err) | ||
| } | ||
|
|
||
| return stream.Send(&nodeattestor.FetchAttestationDataResponse{ | ||
| AttestationData: &common.AttestationData{ | ||
| Type: pluginName, | ||
| Data: data, | ||
| }, | ||
| SpiffeId: k8s.AgentID(config.trustDomain, config.cluster, uuid), | ||
| }) | ||
| } | ||
|
|
||
| func (p *SATAttestorPlugin) Configure(ctx context.Context, req *spi.ConfigureRequest) (resp *spi.ConfigureResponse, err error) { | ||
| hclConfig := new(SATAttestorConfig) | ||
| if err := hcl.Decode(hclConfig, req.Configuration); err != nil { | ||
| return nil, satError.New("unable to decode configuration: %v", err) | ||
| } | ||
|
|
||
| if req.GlobalConfig == nil { | ||
| return nil, satError.New("global configuration is required") | ||
| } | ||
| if req.GlobalConfig.TrustDomain == "" { | ||
| return nil, satError.New("global configuration missing trust domain") | ||
| } | ||
| if hclConfig.Cluster == "" { | ||
| return nil, satError.New("configuration missing cluster") | ||
| } | ||
|
|
||
| config := &satAttestorConfig{ | ||
| trustDomain: req.GlobalConfig.TrustDomain, | ||
| cluster: hclConfig.Cluster, | ||
| tokenPath: hclConfig.TokenPath, | ||
| } | ||
| if config.tokenPath == "" { | ||
| config.tokenPath = defaultTokenPath | ||
| } | ||
|
|
||
| p.setConfig(config) | ||
| return &spi.ConfigureResponse{}, nil | ||
| } | ||
|
|
||
| func (p *SATAttestorPlugin) GetPluginInfo(context.Context, *spi.GetPluginInfoRequest) (*spi.GetPluginInfoResponse, error) { | ||
| return &spi.GetPluginInfoResponse{}, nil | ||
| } | ||
|
|
||
| func (p *SATAttestorPlugin) getConfig() (*satAttestorConfig, error) { | ||
| p.mu.RLock() | ||
| defer p.mu.RUnlock() | ||
| if p.config == nil { | ||
| return nil, satError.New("not configured") | ||
| } | ||
| return p.config, nil | ||
| } | ||
|
|
||
| func (p *SATAttestorPlugin) setConfig(config *satAttestorConfig) { | ||
| p.mu.Lock() | ||
| defer p.mu.Unlock() | ||
| p.config = config | ||
| } | ||
|
|
||
| func loadTokenFromFile(path string) (string, error) { | ||
| data, err := ioutil.ReadFile(path) | ||
| if err != nil { | ||
| return "", errs.Wrap(err) | ||
| } | ||
| if len(data) == 0 { | ||
| return "", errs.New("%q is empty", path) | ||
| } | ||
| return string(data), nil | ||
| } |
Oops, something went wrong.