6 Commits

Author	SHA1	Message	Date
Justin SB	c67f895226	Perform challenge callbacks into a node ... In order to verify that the caller is running on the specified node, we source the expected IP address from the cloud, and require that the node set up a simple challenge/response server to answer requests. Because the challenge server runs on a port outside of the nodePort range, this also makes it harder for pods to impersonate their host nodes - though we do combine this with TPM and similar functionality where it is available.	2023-05-06 08:03:21 -04:00
Jesse Haka	8e6199fa39	exit gracefully if server already exists in k8s	2023-02-12 16:52:13 +02:00
Jesse Haka	b3c134be06	make openstack kops-controller boostrap auth better	2023-01-19 10:07:11 +02:00
John Gardiner Myers	73f164e229	Use instance ID as node name when AWS CCM supports it	2021-11-30 17:54:54 -08:00
justinsb	4dc2c062fd	Support GCE TPM verification	2021-10-06 08:40:20 -04:00
justinsb	fad6db8beb	Refactor bootstrap verifier/authenticator into its own package ... No code changes, but this avoids a circular package dependency that we would otherwise introduce in the GCE logic.	2021-09-26 09:43:53 -04:00