kubernetes-sigs/cluster-api
Security Self Assessment: [STRIDE-SPOOF-4][STRIDE-SPOOF-5] Machine attestation for secure kubelet registration
Offen
#3.762 geöffnet am 07.10.2020
area/securityhelp wantedkind/featurepriority/important-longtermsig/securitytriage/accepted
Repository-Metriken
- Stars
- (4.267 Sterne)
- PR-Merge-Metriken
- (PR-Metriken ausstehend)
Beschreibung
User Story
As a security operator, I want to ensure developers who have access to create MachineDeployments are not able to gain access to data for workloads on a cluster they are not supposed to.
Detailed Description
kubeadm bootstrap tokens allow registration as arbitrary node names. GCP, EKS and Kops provide mechanisms to attest to the identity of a node such that they do not inadvertently get access to secrets and volumes not intended for that node. Provide a mechanism to resolve.
Anything else you would like to add:
[Miscellaneous information that will assist in solving the issue.]
/kind feature