Add solution design for Authn-K8s namespace label constraint #2603
Conversation
![codeclimate[bot]](https://avatars.githubusercontent.com/in/9403?s=60&v=4){kind=small}
john-odonnell
force-pushed
the
label-selector-design
branch
4 times, most recently
from
aa3deda to
e7cb9fb
Compare
|
|
||
| | **Subject** | **Description** | **Issue Mitigation** | | ||
| |-------------|-----------------|----------------------| | ||
| | **Many Similarly-Labeled Namespaces** | Using Kubernetes' native label selector implementation would mean receiving a list of all similarly-labeled namespaces, and limiting those results further based on a request's origin namespace. For a cluster with many similarly-labeled namespaces, this operation could be costly. | Instead of querying the Kubernetes API for a list of all similarly-labeled namespaces, we can get only the request's origin namespace, and then validate its labels against the configured selector locally. This means Conjur is only ever querying for a single resource instead of a open-ended multitude. | |
There was a problem hiding this comment.
Worth mentioning that from a performance standpoint, it's still one more call than all our other types of authentications? (service account, controller, namespace and so on)
Because in others, we query the Pod and we get all the relevant information we need from that object. Here we will need to perform one more call, on the Namespace object of the Pod to get its labels.
|
|
||
| | **Security Issue** | **Description** | **Resolution** | | ||
| |--------------------|-----------------|----------------| | ||
| | **Added Permissions** | The Authenticator identity needs a new permission to get any namespace in a cluster. | This is necessary, and an improvement over requiring permission to list all namespaces in a cluster. List permission means the identity can discover unknown resources, but get permission requires knowledge of existing resources. | |
There was a problem hiding this comment.
The permission is required only in the namespaces in which Conjur needs to provide service.
Since we currently already provide permissions on a per namespace level (as a guideline we don't recommend cluster wide permission to Conjur), then this new permission will be on these namespaces only as well.
john-odonnell
force-pushed
the
label-selector-design
branch
from
e7cb9fb to
344c792
Compare
design/authenticators/authn_k8s/namespace_label_authenticator.md
Outdated
Show resolved
Hide resolved
design/authenticators/authn_k8s/namespace_label_authenticator.md
Outdated
Show resolved
Hide resolved
design/authenticators/authn_k8s/namespace_label_authenticator.md
Outdated
Show resolved
Hide resolved
design/authenticators/authn_k8s/namespace_label_authenticator.md
Outdated
Show resolved
Hide resolved
design/authenticators/authn_k8s/namespace_label_authenticator.md
Outdated
Show resolved
Hide resolved
john-odonnell
force-pushed
the
label-selector-design
branch
from
344c792 to
b0f8978
Compare
| a good way to justify this scope of identity privilege, but it also means | ||
| that workloads across namespace groups either: | ||
|
|
||
| - must use the same type of authentication sidecar (`authenticator`, |
There was a problem hiding this comment.
Inconsistent indentation for list items at the same level
|
|
||
| - must use the same type of authentication sidecar (`authenticator`, | ||
| `secrets-provider-for-k8s`) | ||
| - must use a standard, and possibly misrepresentative, container name for all |
There was a problem hiding this comment.
Inconsistent indentation for list items at the same level
| a good way to justify this scope of identity privilege, but it also means | ||
| that workloads across namespace groups either: | ||
|
|
||
| - must use the same type of authentication sidecar (`authenticator`, |
| - !host | ||
| id: test-app | ||
| annotations: | ||
| authn-k8s/namespace-label: "key1=value1" |
|
|
||
| ## Definition of Done | ||
|
|
||
| - Solution designed is approved |
|
Code Climate has analyzed commit b0f8978 and detected 80 issues on this pull request. Here's the issue category breakdown:
The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 90.0% (-1.5% change). View more on Code Climate. |
Desired Outcome
Add solution design for Authn-K8s namespace label constraint
Implemented Changes
N/A
Connected Issue/Story
CyberArk internal issue link: ONYX-21265
Definition of Done
At least 1 todo must be completed in the sections below for the PR to be
merged.
Changelog
CHANGELOG update
Test coverage
changes, or
Documentation
READMEs) were updated in this PRBehavior
Security