8 Commits

Author	SHA1	Message	Date
Justin SB	c67f895226	Perform challenge callbacks into a node ... In order to verify that the caller is running on the specified node, we source the expected IP address from the cloud, and require that the node set up a simple challenge/response server to answer requests. Because the challenge server runs on a port outside of the nodePort range, this also makes it harder for pods to impersonate their host nodes - though we do combine this with TPM and similar functionality where it is available.	2023-05-06 08:03:21 -04:00
justinsb	4dc2c062fd	Support GCE TPM verification	2021-10-06 08:40:20 -04:00
justinsb	fad6db8beb	Refactor bootstrap verifier/authenticator into its own package ... No code changes, but this avoids a circular package dependency that we would otherwise introduce in the GCE logic.	2021-09-26 09:43:53 -04:00
John Gardiner Myers	babf07136e	Use regional STS endpoint	2021-07-24 22:33:30 -07:00
Justin SB	4ac9d5c17b	Boot nodes without state store access ... kops-controller can now serve the instance group & cluster config to nodes, as part of the bootstrap process. This enables nodes to boot without access to the state store (i.e. without S3 / GCS / etc permissions) Feature-flagged behind the KopsControllerStateStore feature-flag.	2021-01-09 13:08:48 -05:00
John Gardiner Myers	1a253dc574	Send the STS queries to the local region	2020-08-15 10:30:22 -07:00
John Gardiner Myers	9e99f76a6e	Address review comments	2020-08-15 10:30:21 -07:00
John Gardiner Myers	cfa262a81a	Authenticate from nodeup to kops-controller	2020-08-15 09:50:08 -07:00