8000 ☂️ [GEP-26] Workload Identity - Trust Based Authentication · Issue #9586 · gardener/gardener · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

☂️ [GEP-26] Workload Identity - Trust Based Authentication #9586

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
57 of 68 tasks
vpnachev opened this issue Apr 15, 2024 · 3 comments
Open
57 of 68 tasks

☂️ [GEP-26] Workload Identity - Trust Based Authentication #9586

vpnachev opened this issue Apr 15, 2024 · 3 comments
Assignees
@vpnachev @dimityrmirchev
Labels
area/ipcei IPCEI (Important Project of Common European Interest) area/security Security related ipcei/workload-identity Epic for Gardener Workload Identity scenarios kind/enhancement Enhancement, improvement, extension kind/epic Large multi-story topic

Comments

@vpnachev
Copy link
Member
vpnachev commented Apr 15, 2024 •
edited
Loading

How to categorize this issue?
/area security
/kind enhancement

This is an umbrella issue for implementing the changes proposed in GEP-26

Tasks

API Server

Admission Controller

Controller Manager

Gardenlet

Operator

Discovery Server

Extensions

AWS

Azure

GCP

Alicloud

  • Enhance MCM to use credentials mounted as volume
  • Validation of the WorkloadIdentity resource
  • Infrastructure controller to write the token on unique filepath per cluster
  • Extension admission controller adjusts the secret with the token and metadata

Enablement

Development Setup

Gardenctl

Dashboard
@gardener-prow gardener-prow bot added area/security Security related kind/enhancement Enhancement, improvement, extension labels Apr 15, 2024
@vpnachev
Copy link
Member Author

/assign @vpnachev

@JordanJordanov JordanJordanov added the area/ipcei IPCEI (Important Project of Common European Interest) label Apr 16, 2024
@vpnachev vpnachev mentioned this issue Apr 19, 2024
Merged
@vpnachev vpnachev mentioned this issue May 10, 2024
Merged
@vpnachev
Copy link
Member Author

/kind epic

@gardener-prow gardener-prow bot added the kind/epic Large multi-story topic label May 14, 2024
@vpnachev vpnachev mentioned this issue May 16, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue May 17, 2024
Merged
@JordanJordanov JordanJordanov added the ipcei/workload-identity Epic for Gardener Workload Identity scenarios label May 21, 2024
@vpnachev vpnachev mentioned this issue May 21, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue May 27, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Jun 24, 2024
Merged
@vpnachev vpnachev mentioned this issue Jun 27, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Jul 23, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Jul 31, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Aug 9, 2024
Merged
@vpnachev vpnachev mentioned this issue Aug 12, 2024
Merged
This was referenced Aug 14, 2024
Closed
Merged
Merged
@vpnachev vpnachev mentioned this issue Aug 16, 2024
Merged
@dimityrmirchev
Copy link
Member
dimityrmirchev commented Aug 20, 2024 •
edited
Loading

Current state

The current proposal allows changing credentialsBinding.CredentialsRef which is convenient but can also cause unwanted behavior. Let's imagine the following scenario. A user has access to a CredentialsBinding that references a Secret that is controlled by another organisation and is in another namespace. The user can reference this Secret for the purpose of creating a trial cluster. Now once the user has finished experimenting they can create their own Secret and point the existing CredentialsBinding to it. This will lead to a change in the provider accounts and the resources created in the trial account will be considered orphaned. We want to avoid that.

Proposal

I propose that we make credentialsBinding.CredentialsRef immutable and shoot.CredentialsBindingName mutable (but on condition). Migration from shoot.SecretBindingName to shoot.CredentialsBindingName will only be possible if the SecretBinding and the CredentialsBinding both reference exactly the same Secret and Quotas. We will allow changing the shoot.CredentialsBindingName when the user making the request has read permissions for both "old" and "new" credential. This will ensure that users that have access to a CredentialsBinding referencing a credential in another namespace cannot suddenly reference their own credential and leak the already created resources in another account. This check will only be made when a Shoot is updated, but not during creation.

@dimityrmirchev dimityrmirchev mentioned this issue Aug 21, 2024
Merged
@vpnachev vpnachev mentioned this issue Aug 21, 2024
Closed
@dimityrmirchev dimityrmirchev mentioned this issue Aug 23, 2024
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Sep 4, 2024
Merged
This was referenced Oct 22, 2024
Merged
Closed
This was referenced Oct 31, 2024
Merged
Merged
Merged
Closed
Merged
Merged
This was referenced Nov 13, 2024
Open
Closed
This was referenced Nov 20, 2024
Merged
Merged
Merged
Merged
@vpnachev vpnachev mentioned this issue Jan 14, 2025
Closed
@vpnachev vpnachev mentioned this issue Jan 26, 2025
Merged
@etiennnr etiennnr mentioned this issue Feb 19, 2025
Closed
@dimityrmirchev dimityrmirchev mentioned this issue Feb 21, 2025
Merged
@vpnachev vpnachev mentioned this issue Mar 4, 2025
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Apr 8, 2025
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Apr 28, 2025
Closed
@vpnachev vpnachev mentioned this issue Apr 28, 2025
Merged
@dimityrmirchev dimityrmirchev mentioned this issue Apr 29, 2025
Merged
This was referenced May 5, 2025
Merged
Merged
This was referenced May 14, 2025
Merged
Merged
This was referenced May 22, 2025
Merged
Open
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vpnachev vpnachev

@dimityrmirchev dimityrmirchev

Labels
area/ipcei IPCEI (Important Project of Common European Interest) area/security Security related ipcei/workload-identity Epic for Gardener Workload Identity scenarios kind/enhancement Enhancement, improvement, extension kind/epic Large multi-story topic
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@vpnachev @dimityrmirchev @JordanJordanov
0