14 Commits

Author	SHA1	Message	Date
Justin SB	c67f895226	Perform challenge callbacks into a node ... In order to verify that the caller is running on the specified node, we source the expected IP address from the cloud, and require that the node set up a simple challenge/response server to answer requests. Because the challenge server runs on a port outside of the nodePort range, this also makes it harder for pods to impersonate their host nodes - though we do combine this with TPM and similar functionality where it is available.	2023-05-06 08:03:21 -04:00
Jesse Haka	b3c134be06	make openstack kops-controller boostrap auth better	2023-01-19 10:07:11 +02:00
John Gardiner Myers	73f164e229	Use instance ID as node name when AWS CCM supports it	2021-11-30 17:54:54 -08:00
Eng Zer Jun	425173ae9f	refactor: move from io/ioutil to io and os packages ... The io/ioutil package has been deprecated as of Go 1.16, see https://golang.org/doc/go1.16#ioutil. This commit replaces the existing io/ioutil functions with their new definitions in io and os packages. Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>	2021-11-12 15:37:18 +08:00
justinsb	4dc2c062fd	Support GCE TPM verification	2021-10-06 08:40:20 -04:00
justinsb	fad6db8beb	Refactor bootstrap verifier/authenticator into its own package ... No code changes, but this avoids a circular package dependency that we would otherwise introduce in the GCE logic.	2021-09-26 09:43:53 -04:00
Ole Markus With	ad16042a1f	Add IPs to kubelet server cert ... Since AWS does not resolve instance hostnames to ipv6, ipv6-only pods that talk to kubelet API has to use node IP, not hostname. Thus we need to add IPs to kubelet server cert.	2021-08-26 20:54:02 +02:00
John Gardiner Myers	babf07136e	Use regional STS endpoint	2021-07-24 22:33:30 -07:00
Justin SB	4ac9d5c17b	Boot nodes without state store access ... kops-controller can now serve the instance group & cluster config to nodes, as part of the bootstrap process. This enables nodes to boot without access to the state store (i.e. without S3 / GCS / etc permissions) Feature-flagged behind the KopsControllerStateStore feature-flag.	2021-01-09 13:08:48 -05:00
John Gardiner Myers	1a253dc574	Send the STS queries to the local region	2020-08-15 10:30:22 -07:00
John Gardiner Myers	5dcc95178f	Verify the ARN's partition	2020-08-15 10:30:22 -07:00
John Gardiner Myers	9e99f76a6e	Address review comments	2020-08-15 10:30:21 -07:00
John Gardiner Myers	9cfa169740	Add server code to kops-controller	2020-08-15 10:30:15 -07:00
John Gardiner Myers	cfa262a81a	Authenticate from nodeup to kops-controller	2020-08-15 09:50:08 -07:00