Conversation
strideynet
reviewed
Nov 21, 2022
Contributor
strideynet
left a comment
strideynet
left a comment
There was a problem hiding this comment.
Overall looks good - nice work. Just a few nits.
I couldn't leave this as a comment, but a lib/kubernetestoken/kubernetestoken.go which just has a comment linking to the RFD and also linking to the appropriate docs on the Kubernetes site would be 👌
I'm thinking we maybe ought to group all of the join method packages at some-point now that we have 3 ! Perhaps that's better suited for a separate PR though...
phosphore
approved these changes
Nov 22, 2022
There was a problem hiding this comment.
While the prefix system: should be reserved for internal Kubernetes system use, I believe nothing prevents a normal user or group to start with the system: prefix and bypass this? https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-subjects
A better check would probably involve looking at the assigned groups (i.e. at least reviewResult.Status.User.Groups including system:serviceaccounts).
Contributor
Author
There was a problem hiding this comment.
I was not able to find any information about checks and security enforcement around username prefix and reserved groups. I will add the group check as well.
hugoShaka
force-pushed
the
hugo/kube-join-tokens
branch
2 times, most recently
from
28cd8d5 to
da20949
Compare
strideynet
requested changes
Nov 29, 2022
strideynet
reviewed
Nov 29, 2022
strideynet
approved these changes
Nov 30, 2022
ibeckermayer
approved these changes
Nov 30, 2022
nklaassen
reviewed
Dec 1, 2022
Contributor
There was a problem hiding this comment.
this line could probably use an update
Do you think we should add an item to the test plan for a manual check of this in a real kube cluster?
It all looks pretty good to me, I left mostly minor comments you can take or leave or do in a separate PR.
nklaassen
reviewed
Dec 1, 2022
Contributor
Author
|
Following a discussion with nic I will move tbot out of this PR scope as it is untested and was broken. I definitely will bring this feature back once we have a working tbot in kubernetes (like the operator), this will allow to move the teleport operator out if its sidecar and have it join the cluster nicely. |
hugoShaka
force-pushed
the
hugo/kube-join-tokens
branch
from
f9e2791 to
14ba207
Compare
nklaassen
reviewed
Dec 2, 2022
Co-authored-by: Noah Stride <noah.stride@goteleport.com>
Co-authored-by: Isaiah Becker-Mayer <isaiah@goteleport.com>
hugoShaka
force-pushed
the
hugo/kube-join-tokens
branch
from
f89e6d0 to
21968ff
Compare
hugoShaka
force-pushed
the
hugo/kube-join-tokens
branch
from
6cc5ffd to
5da9d0d
Compare
hugoShaka
added a commit
that referenced
this pull request
Feb 16, 2023
This commit adds a new joinMethod as described in #17905 This method allow pods running in the same Kubernetes cluster than the auth servers to join the Teleport cluster. It relies on Kubernetes tokens to establish trust. The goal is to be able to deploy proxies and auths separately and join them in a single cluser. Pre Kubernetes 1.20, the tokens are static, long-lived, not bound to pods. We support them for compatibility reasons. Starting with Kubernetes 1.20, tokens are bound to pods (and starting with 1.21 they can be mounted through projected volumes). Starting with 1.21 we should only accept bound tokens. The chart will ensure tokens are properly mounted with projected volumes so we can benefit from the 1h to 10min token lifetime.
hugoShaka
added a commit
that referenced
this pull request
Feb 20, 2023
This commit adds a new joinMethod as described in #17905 This method allow pods running in the same Kubernetes cluster than the auth servers to join the Teleport cluster. It relies on Kubernetes tokens to establish trust. The goal is to be able to deploy proxies and auths separately and join them in a single cluser. Pre Kubernetes 1.20, the tokens are static, long-lived, not bound to pods. We support them for compatibility reasons. Starting with Kubernetes 1.20, tokens are bound to pods (and starting with 1.21 they can be mounted through projected volumes). Starting with 1.21 we should only accept bound tokens. The chart will ensure tokens are properly mounted with projected volumes so we can benefit from the 1h to 10min token lifetime.
hugoShaka
added a commit
that referenced
this pull request
Feb 24, 2023
This commit adds a new joinMethod as described in #17905 This method allow pods running in the same Kubernetes cluster than the auth servers to join the Teleport cluster. It relies on Kubernetes tokens to establish trust. The goal is to be able to deploy proxies and auths separately and join them in a single cluser. Pre Kubernetes 1.20, the tokens are static, long-lived, not bound to pods. We support them for compatibility reasons. Starting with Kubernetes 1.20, tokens are bound to pods (and starting with 1.21 they can be mounted through projected volumes). Starting with 1.21 we should only accept bound tokens. The chart will ensure tokens are properly mounted with projected volumes so we can benefit from the 1h to 10min token lifetime.
hugoShaka
added a commit
that referenced
this pull request
Feb 24, 2023
Backport #18659 ### About the backport This backport is here to provide a rollback path from v12 to v11. Helm users upgrading to v12 end up with Kubernetes tokens automatically created. Currently, if they rollback to v11, the token is unknown and Teleport crashes during cache warming. Once this will be backported, users will have a v11 version they can rollback to if the v12 upgrade fails. ### Original commit message This commit adds a new joinMethod as described in #17905 This method allow pods running in the same Kubernetes cluster than the auth servers to join the Teleport cluster. It relies on Kubernetes tokens to establish trust. The goal is to be able to deploy proxies and auths separately and join them in a single cluser. Pre Kubernetes 1.20, the tokens are static, long-lived, not bound to pods. We support them for compatibility reasons. Starting with Kubernetes 1.20, tokens are bound to pods (and starting with 1.21 they can be mounted through projected volumes). Starting with 1.21 we should only accept bound tokens. The chart will ensure tokens are properly mounted with projected volumes so we can benefit from the 1h to 10min token lifetime.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds a new joinMethod as described in #17905
This method allow pods running in the same Kubernetes cluster than the auth servers to join the Teleport cluster. It relies on Kubernetes tokens to establish trust. The goal is to be able to deploy proxies and auths separately and join them in a single cluser.
Pre Kubernetes 1.20, the tokens are static, long-lived, not bound to pods. We support them for compatibility reasons. Starting with Kubernetes 1.20, tokens are bound to pods (and starting with 1.21 they can be mounted through projected volumes). Starting with 1.21 we should only accept bound tokens. The chart will ensure tokens are properly mounted with projected volumes so we can benefit from the 1h to 10min token lifetime.