kubernetes-sigs/cluster-api

Security Self Assessment: [STRIDE-SPOOF-4][STRIDE-SPOOF-5] Machine attestation for secure kubelet registration

Open

#3,762 opened on Oct 7, 2020

View on GitHub
 (15 comments) (1 reaction) (0 assignees)Go (1,532 forks)auto 404
area/securityhelp wantedkind/featurepriority/important-longtermsig/securitytriage/accepted

Repository metrics

Stars
 (4,267 stars)
PR merge metrics
 (PR metrics pending)

Description

User Story

As a security operator, I want to ensure developers who have access to create MachineDeployments are not able to gain access to data for workloads on a cluster they are not supposed to.

Detailed Description

kubeadm bootstrap tokens allow registration as arbitrary node names. GCP, EKS and Kops provide mechanisms to attest to the identity of a node such that they do not inadvertently get access to secrets and volumes not intended for that node. Provide a mechanism to resolve.

Anything else you would like to add:

[Miscellaneous information that will assist in solving the issue.]

/kind feature

Contributor guide

Research direction
Research the current kubelet registration process with bootstrap tokens and study existing machine attestation methods in cloud providers (GCP, AWS, Azure). Propose a design to integrate attestation into Cluster API's machine provisioning flow.
Tech stack
go
Domain
security
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Stale
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
GoKubernetesSecurity
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20