Secure CSI Driver TCP Connections via Substrate Pod Identity - #956
Secure CSI Driver TCP Connections via Substrate Pod Identity#956hajiler wants to merge 1 commit into
Conversation
7837061 to
ac4da29
Compare
CONV=08b81b20-9977-45df-b98e-9e340bc55e2d
|
/lgtm Seems to do the right thing from what I understand. |
|
/assgin Michael Taufen (@mtaufen) |
| # | ||
| # This exposes the hostpath's Unix domain csi.sock as a TCP port to the | ||
| # outside world. The mapping from Unix domain socket to TCP is done | ||
| # by socat. |
There was a problem hiding this comment.
Seems like it is no longer done with socat?
| match_typed_subject_alt_names: | ||
| - san_type: URI | ||
| matcher: | ||
| exact: "spiffe://cluster.local/ns/ate-system/sa/ate-api-server" |
There was a problem hiding this comment.
In the near future we are going to have to make the cluster.local part configurable. What sort of matches does Envoy support in its config?
| } | ||
|
|
||
| // Load CA Pool | ||
| caPoolBytes, err := os.ReadFile(paths.caCert) |
There was a problem hiding this comment.
The CA file may update on disk if the CA goes through a rotation.
We may need to copy the CA handling code from https://github.com/ahmedtd/tinycert/blob/main/lib/spiffefsd/spiffefsd.go (I wrote this under the terms of my IP agreement with Google, and it's Apache-licensed, so it's fine to copy in and attribute to Google)
By default tls.Config only allows specifying a static pool of root certificates. We have to use the combination of InsecureSkipVerify and VerifyConnection to enable automatic reloading.
3 participants
Secures network-based gRPC connections between the ate-api control plane and CSI driver controller services using mutual TLS (mTLS) backed by Substrate's Pod Identity.
Requests from ate-api to CSI driver controllers occur over the network, as configured via the CSIDriverConfig custom resource. This PR extends the CSIDriverConfig CRD to include a tls configuration section, which leverages
Substrate's Pod Identity certificate infrastructure (managed by podcertcontroller) to secure these
TCP connections using mTLS. Because standard CSI drivers typically communicate over Unix domain sockets, a proxy sidecar (e.g., envoy) is added to the CSI controller deployment to terminate TLS and forward requests to the local CSI socket.
#232