10 Commits

Author	SHA1	Message	Date
justinsb	010a0d5e4c	feat: Support PKI bootstrap ... Similar to the TPM bootstrapping on GCE (indeed, a lot of the code is modified from there), but we verify the PKI signature against a public key in a Host CRD object.	2023-11-30 18:35:58 -05:00
justinsb	592b575412	feat: Support multiple token verifiers in kops-controller ... This will allow us to support nodes running in multiple clouds. If we don't configure multiple verifiers, this should be a no-op.	2023-11-30 10:44:53 -05:00
John Gardiner Myers	1ea0fd3004	AWS always uses resource-based names	2023-09-04 16:08:48 -07:00
Justin SB	c67f895226	Perform challenge callbacks into a node ... In order to verify that the caller is running on the specified node, we source the expected IP address from the cloud, and require that the node set up a simple challenge/response server to answer requests. Because the challenge server runs on a port outside of the nodePort range, this also makes it harder for pods to impersonate their host nodes - though we do combine this with TPM and similar functionality where it is available.	2023-05-06 08:03:21 -04:00
Jesse Haka	8e6199fa39	exit gracefully if server already exists in k8s	2023-02-12 16:52:13 +02:00
Jesse Haka	b3c134be06	make openstack kops-controller boostrap auth better	2023-01-19 10:07:11 +02:00
Ole Markus With	ce2e877aeb	Remove bazel files from vendor	2022-04-12 13:29:03 +02:00
John Gardiner Myers	73f164e229	Use instance ID as node name when AWS CCM supports it	2021-11-30 17:54:54 -08:00
justinsb	4dc2c062fd	Support GCE TPM verification	2021-10-06 08:40:20 -04:00
justinsb	fad6db8beb	Refactor bootstrap verifier/authenticator into its own package ... No code changes, but this avoids a circular package dependency that we would otherwise introduce in the GCE logic.	2021-09-26 09:43:53 -04:00