8 Commits

Author	SHA1	Message	Date
justinsb	592b575412	feat: Support multiple token verifiers in kops-controller ... This will allow us to support nodes running in multiple clouds. If we don't configure multiple verifiers, this should be a no-op.	2023-11-30 10:44:53 -05:00
John Gardiner Myers	1ea0fd3004	AWS always uses resource-based names	2023-09-04 16:08:48 -07:00
justinsb	1faee9dd8c	digitalocean: bootstrap nodes through kops-controller. ... We start with a simple node verifier.	2023-05-07 13:17:56 -04:00
Justin SB	c67f895226	Perform challenge callbacks into a node ... In order to verify that the caller is running on the specified node, we source the expected IP address from the cloud, and require that the node set up a simple challenge/response server to answer requests. Because the challenge server runs on a port outside of the nodePort range, this also makes it harder for pods to impersonate their host nodes - though we do combine this with TPM and similar functionality where it is available.	2023-05-06 08:03:21 -04:00
Jesse Haka	8e6199fa39	exit gracefully if server already exists in k8s	2023-02-12 16:52:13 +02:00
Justin SB	9b02017059	openstack verifier: support IPv6 ... Add IPv6 support to the openstack verifier and polish up a few error messages.	2023-01-28 10:54:48 -05:00
Jesse Haka	b3c134be06	make openstack kops-controller boostrap auth better	2023-01-19 10:07:11 +02:00
Jesse Haka	3dab0eb807	Use kops-controller to boostrap nodes in OpenStack	2023-01-14 13:54:14 +02:00