Spec: Store spiffeID of NSE in NetworkSerivceEndpoint message

[NikitaSkrynnik]

Description

Current implementation of authorization for registry may be insecure when registry restarts.

Current behavior

When NSE goes to registry to register itself, registry stores it's spiffeID in a map. Registry uses this map to check that different spiffeIDs don't register NSEs with the same names. When registry restarts, the map is removed, and bad NSE has a possibility to register itself under the name of a good NSE.

Solution

• We can use gRPC metadata to transfer path, which is private and constracted during Registeration of Endpoint. Authorize chain element can get private path from gRPC medatada and check policies.
• We can store spiffeID in NSE entry in etcd. When a bad NSE tries to register itself as a good NSE, we can get entry from etcd and check that spiffeID of a good one is equal to spiffeID of a bad one. If spiffeIDs are different, registry won't allow bad NSE to register. It would work even if registry restarted, because spiffeID of good NSE is stored in etcd. (Options for how we can store spiffe id are listed below)

Options

We can store additional information in NSE CRD that can be helpful for future authorization cases. Also we can use NSE labels to store spiffeID.

Option 1: Store only NSE spiffeID in NSE CRD

Fixes registry security issue.

message NetworkServiceEndpoint {
    string name = 1;
    repeated string network_service_names = 2;
    map<string, NetworkServiceLabels> network_service_labels = 3;
    string url = 4;
    string id = 5;
    google.protobuf.Timestamp expiration_time = 6;
    google.protobuf.Timestamp initial_registration_time = 7;
}

Option 2: Store a list of spiffeIDs in NSE CRD from the path that was constructed during initial NSE registration

Fixes registry security issue. It may be useful for authorization cases that we haven't considered yet

message NetworkServiceEndpoint {
    string name = 1;
    repeated string network_service_names = 2;
    map<string, NetworkServiceLabels> network_service_labels = 3;
    string url = 4;
    repeated string path_ids = 5;
    google.protobuf.Timestamp expiration_time = 6;
    google.protobuf.Timestamp initial_registration_time = 7;
}

Option 3: Store spiffeID of NSE in NSE labels.

Fixes registry sequrity issue. Doesn't require any changes in API

nse := &registryapi.NetworkServiceEndpoint{
		Name: "nse",
		NetworkServiceLabels: map[string]*registryapi.NetworkServiceLabels{
			"networkservice": {
				Labels: map[string]string{
					"id": "spiffe://test.com/nse",
				},
			},
		},
		NetworkServiceNames: []string{"networkservice"},
	}

[denis-tingaikin]

@NikitaSkrynnik Could you also add proto examples to clarify options?

# TODO

[NikitaSkrynnik]

Subtasks

• Refactor updatepath registry chain element ~ 12h
• Update all cmd repositories ~ 12h
• Check and fix integration tests ~ 24h

[NikitaSkrynnik]

sdk updates

• Add registry/updatepath chain elements sdk-k8s#404
• [qfix] add json:"token" tag for PathSegment.Token sdk#1389
• [qfix] Swap begin and updatepath chain elements in all registries sdk#1390

cmd repository updates

• Add registry authorization cmd-registry-proxy-dns#547
• Add registry authorization cmd-nse-remote-vlan#118
• Add registry authorization cmd-nse-vfio#407
• Fix function parameters in proxydns.NewServer cmd-nsc-simple-docker#44
• Add registry authorization cmd-nse-supplier-k8s#231
• Add registry authorization cmd-nse-l7-proxy#61
• Add registry authorization cmd-nse-simple-vl3-docker#64
• Add registry authorization cmd-nse-vl3-vpp#138
• Add registry authorization cmd-nse-firewall-vpp#323
• Add registry authorization cmd-nse-icmp-responder-vpp#492
• Add registry authorization cmd-nse-vlan-vpp#235
• Add registry authorization cmd-forwarder-vpp#756
• Add registry authorization cmd-forwarder-sriov#544
• Add registry authorization cmd-forwarder-ovs#198
• Fix TestNSMgrEndpointRegister test cmd-nsmgr#560
• Add registry authorization cmd-nsmgr#563
• Add registry authorization cmd-nse-icmp-responder#488
• Add registry authorization cmd-registry-memory#562
• Add registry authorization cmd-registry-k8s#354

[denis-tingaikin]

Seems like completed by #148 (comment)

@NikitaSkrynnik Thanks!