[RFD] 0143 - External Kubernetes Joining

[strideynet]

This RFD proposes a method for allowing entities (such as a Machine ID instance
or an Agent) to join Teleport Clusters via federation between the Kubernetes
Cluster they reside in and a Teleport Cluster, where that Teleport Cluster does
not reside in the same Kubernetes Cluster.

Part of #25543

[hugoShaka]

LGTM, my only remaining concern with the model is the infinitely renewable token. We might want folks from security to look at this. IIRC, we asked for an external audit last time I added a joining method.

[tigrato]

+1 for security audit

[strideynet]

[jentfoo]

Risks are well articulated. I don't see any additional risks, or room for improvement. However I have sent this to Doyensec so they can additionally review this RFD.

[strideynet]

"Blocked" awaiting an external review.

[zmb3]

Any new audit events as part of this work? We often get dinged in security reviews for missing audit events, and despite having a section dedicated to them in the RFD template I don't see any information on them here.

[strideynet]

@zmb3 I'll add this to the RFD - in the actual implementation I've not added any new audit events (since we already emit them for Bot/Agent joins) - but I have improved the richness of the existing Kubernetes Join audit event in a similar way that we do for GitHub joining (e.g the token fields are included in the audit event).

[strideynet]

Completed in 42f9d3a

[SzymonDrosdzol]

I have left a couple of small improvements to JWT validation process for consideration.
Otherwise, looks good.