Antrea Community, 25 Apr 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Antrea Community Meeting 04/25/2022

Description

Antrea Community Meeting, April 25th 2022

A

All right, so, unless I'm mistaken, welcome everyone sorry welcome everyone. Welcome to this entry community meeting uh today is uh april, the 25th in the us, and, I guess, april's 26 in in china.

A

um I believe unless we I am mistaken, we have a single item on the agenda and it's a choose that wants to present is designed for ipsec certificate based authentication.

A

So, are you ready to present this.

B

Yes, thank you.

B

So I will share my script.

B

uh I think I think I see it.

A

Yeah, we can see it yeah.

B

Yeah great yeah, so thank you all for this opportunity to share the data review for abyssal certificate based classification, and I will so. The motivation is that currently android exporter can only use a pre-shared keys and it's it's managed manually.

B

So it's uh it's too limited for enterprise networks and the obs toolkit already supports also getting uh turning points using uh standard uh certificates and for untrue. We only need to manage certificates and load them to each node, so the obs toolkit will be responsible for mounting and configuring as a key dimmer so yeah so things for entry. We only need to find a way to request and issue the certificates and configure them to to each node, and here is the here is the strictly format for for for each node.

B

So, as you can see that the uh the important uh the in the certificate I wish, we should pay attention to the common name section and and as a the obvious uh muay thai aggie stack script will extract the common name section and configure the abisec except.conf to the academy. So it is, it is critical and also we can see that for the uh for the extension section and we mark the key usage to abstract panel.

B

This is not required for for ipsec or for obs, but I think it's a good practice as this is a standard key usage. So we can, I think we can use we can. We can use a piece like tunnel uh to max this key usage and.

B

Yeah yeah, basically this this is a standard, uh x5 tavona certificate and for obs configurations uh we need to start the uh other config fields of uh also open the switch. Basically, we need three fields why the certificate for the node and this corresponding private key also, we also need to. We also need to start the rule certificate for for australian purpose.

B

uh uh We also need to configure the the the panel configurations uh previously for our preferred shared keys.

B

uh We configure a each part with a ps psk and under the another act and the exact pressure key in the options, but uh by using a certificate we only need to start the remote name of the worker of the peer worker nodes. The roman name should match the common name in the in the nodes certificate.

B

As I showed earlier yeah, so that's that's all we need for the obvious configurations, and- and the next thing is that we we need to find a way to request and issue the certificates.

B

So so there is a problem. Is that uh as intelligent parts can uh cannot bounce their own certificates individually, as uh they are managed by demon set so yeah? So it's also not scared to save all the issues, certificates and their private keys in in one secret and loads them in their demo set as a volume. So I think it's it's not secure and and for most cases so uh as uh we we can use uh samsung certificates for for uh the authentication.

B

So I think I struggle to issue a new certificate without processing them in the kubernetes storage database and also grenadiers provide stable certificate. Signing request apis. So it fits nicely with the controller and the agent title venture. So that means the agent can create a certificate sign request through the coordinated api and the android controller can approve and assign it by the by the cr, and then a control agent can get the certificate through the status and save them as files in the node.

B

So so for the root certificate, control controller can generate a self-standard uca and save its save, save it and its private key as a secret. uh Meanwhile, it can also save the certificate in your map.

B

The volume um so so so so this is what the csi api looks like for our use case and, as you can see, that's for the in the specs section on the left. So we have the pm encoded csr and the the certificate request contains the common name of the node and also, we must also specify the signal name, I'm not sure for for the further for the for the naming of the center. So I just name it enter center here and the the usage. As I said before, is his sidestep tunnel.

B

It's five seconds yeah. So uh once the the service signing request got approved, uh you can we can see the status uh in the continuum field it studied. It was automatically approved by the enter.io standard and then the next step, the the the controller will stand the certificate and uh and update the certificate section in the status.

B

So so there is a subtle issue there is that maybe it's not the issue, but uh the part is also the the approved. Denial of other requests will be automatically deleted deleted after one hour. So so this is a community behavior. So we must pay attention to to the to the controller or the controller in the android agent to to make sure we do not need to issue new strategies, as this is why it's still valid.

B

And also, we need to configure the correct our back for our android controller and the entire agent uh for interconneur controller. As you can imagine, we need to give and give it permission for a list and watch the certificate, signing request apis and the more important we need to.

B

Assign permission for the approve and the sign verbs to enter dial center yeah the sender name, as I said earlier, so it will make sure that the android controller will only sign approve, understand the request with the desired center name. It would not touch any other csrs with other server name and also uh as android owner android controller need to uh save its uh roots, uh lucy and uh private key in the secret.

B

So we need to uh controller to create secrets and also update the secrets with name enter, exact, ca, yeah and the foreign agent. You will need to allow, allow you to create and watch the watch, modify the the frequency request.

B

Yeah, that's for the back, and uh for uh and uh nasa is for certificate renewal, so uh it uh so from my understanding. uh I think there are three uh cases so to to renew the certificate. So why is that? The the the science of grid is about this bar, so we can't determine it from the entrance and we can create new uh csrcrs and uh and issued a new certificate.

B

Also it can happen when the the coordinators know the reports. So if we store the private key in the vargas folder on the other node, so I think it will be deleted once the node got rebooted and the last thing is that the rule certificate might be changed, so it can happen when the research certificate is bar or the secret controller controller manager was deleted manually or by accident. So the certificate will will will change uh once the turn and enchantment detects. The change of research is so it will.

B

It will first check whether it is if the on the certificate still matches the certificate.

B

If not, I think it will need to request a new certificate uh and- uh and during my testing I found some uh limitations of the obvious void- type stack script, so it only works for the obvious db changes instead of the file content changes. So so for starter reloading, so we can have the the following workaround.

B

Unfortunately, we can maybe generate a random name for the final certificate and and update the other configurations so that the the script will detect the change of the of the certificate name and updates the update and reload the lucky dimmer, and also we can also uh the option too, is that we can use stack, pick names for certificates, but we can add another field to the other config. For example, we can compute a hash for for the other party roon circuit and the sensor trees and save a hash to the other config.

B

So so the the script also detects changes and and updates the certificates uh later yeah, so that that that's the uh that's the two options for the workaround and the yeah. So that's for the satellite and.

B

Website container needs to be also responsible for for requesting and managing certificates. So, if not, I think it will.

C

It can be handled in the intelligent container.

B

B

And- uh and uh we come on to the same path uh on the other note, so uh the file will be shared in both containers.

B

So, uh if yes, so the we, we must change the the the start, uh script, the starting script of android stack container and we may need to to copy uh some codes of the android games and to uh no no, no, not for cocky.

B

I think we will still need to compile a battery for.

B

Sorry, sorry, it's noisy yeah yeah, uh so so, uh if yes, I think we need to compile uh excessive, uh specific binary for the episode container and it will be responsible for issuing and managing certificates yeah. So I'm not sure which one is better.

B

And yeah, and that's all for for my sharing yeah. Thank you.

C

Thank you for the proposal and can you switch to the screen or for csr workflow part? I want to confirm you are proposing actually two options, but these options are only about how we get the loot certificate, but the certificate of each node. We are always issued by this csr api. Am I right.

B

uh I think for for for those certificates it will be generate d1. It will be generated once uh upon the upon the first running of android controller, so it will save it as a config map, so the enter agent can mount it as a volume.

C

Okay, you mean when it restarts it could uh read the secret directly and reuse. It.

B

Yes, yes, yes, so yeah, so the csr is just for another certificate.

C

Okay, so do we plan to take a user-provided load certificate for signing knowledge certificate.

B

um I I I have think about that, um but uh I think we we can still do that uh if we put some uh some guides to, uh for example, we we can.

B

Oh so as the certificates save down the specific pass or other node, so we may need user to to store their certificates in the specific specific path but yeah, but I'm not sure whether it is a good practice or not.

C

I think even you even the way you resolve the restart case used us store the auto generated certificate in into a secret right. Then, could we just ask user to feel that cigarette if they have their own.

B

um Yeah for my uh format, design, I think for for the node certificate on each node, so we we do not need to to save it as a secret. So I think it doesn't matter.

B

Whether we can reuse it or not, so we can go, we can create a new certificate if it's a deleted bank system or the node reports, so we can always create new certificates for each node. So I don't think we need to save it as secret and I I I cannot find a clear way to to to to load the certificate individually to each node.

C

I mean the certificate the certificate you generated for ca, yeah, yeah, yeah, you, it will be saved yeah yeah. Do you plan to save it to a cigarette or coffee.

B

Man, I think a singapore yeah for for secret. We kindly use it for coffee macbeth. We can allow pause, allow as a trading card to mount it.

C

uh Why we need a trading to monitor if they can get their certificate from csr.

B

uh For the for the csr, the the the certification status only contains uh it only contains the leave certificates of the node, but but um yeah, but we are right. So we can we can. We can append the rule ca to the certificates in status yeah. We can do that, but but for but for obvious confusions. We need a separate file for the for the lucia.

C

You mean this: this certificate field of status is determined by the approval, not kubernetes.

B

Yeah, so this is measured by us yeah we can. We can yeah yeah. We can append the rules here to the certificate section. I think.

C

Yeah then maybe check whether it is recommended to append, in your other implementations, yeah make sense.

C

And uh I have another question: uh maybe the seventh page or the eighth- I'm not sure. Oh yes, in this page, this certificate, hashi value, is an os field or some field.

B

No, no! No! So no! It's it's not is obvious there. So so any changes to the other other conflict.

B

The other config uh fields will trigger the reload of the obvious or more interesting script. So I think we can just add a hash value to it to trigger the update.

C

Oh, I see thank you yeah. What's the original uh fill the name for certificate file, it's.

B

Yes is a certificate seriously kind of privacy.

C

Okay, it sounds like uh using this hashi would be simpler, because if.

B

C

Use certificate file, we need to take care of cleaning still fast yeah yeah.

C

Okay, I don't have other questions so far. Thank you.

C

Oh and uh sorry, I have another question. uh I know that a cuban canadian controller manager has some option to how to upload csr and will that conflict with our own signer.

B

I don't think so, uh as we define our own center name here, so the the the control manager will only approve uh the csr requests for the specific assignment, so it will completely. It will not complete.

C

You you mean it will have other sign or name.

B

C

B

And I won't get to get your opinions about the whether we we we, which which container we should put the logic for and manual certificates. So if we keep the android style container as it is, so we can just mount the same path of traffic and a transient container and the android agent can be responsible for for managing the certificates. So if not, we may need to modify the uh the script in the entire website container. We can. We can compile a dedicated binary for just minor certificates in the container.

C

I assume currently enter agent already. Has some ipsec specific code right yeah code writing for exact? Then probably it is simpler to just how the csr logic in country agent as well, because if you have another go process for this purpose, it will also need to have some certificate. Some token and connection with cuba, api right.

B

Yeah yeah yeah, so I think it will also increase the the image size.

D

Yeah, I would agree, we should probably do the service management and charging that's my feeling. Yes, thank you. Thank.

B

D

Yeah, I think it's not a problem, you you you, you just use the share. The volume between these two containers.

B

Okay start here, thank you.

D

I mean uh you can use I'm I think it's called is a this time called empty dir uh when you create.

B

A volume right.

D

So it's it will not be.

B

D

I think that's that should be good enough.

D

C

Thank you, but, but I think you mentioned that he hit the proposal. The certificate will be finally positioned in the run directory right, the temporary directory, otherwise every restart will cause another csr request. Is this what we wanted.

C

I mean if we use empathy.

D

Yeah, I think she mentioned that he worked. He was just. uh He will not process the safeguarding. That's my she could you confirm.

B

uh I I think, I think, uh for for the formative I I want to save the certificates to the environment pass on the load, so, okay, so it will help for for uh the agent report case. So we don't need to issue new cell fields for for the container, for the portable research.

D

That's only when you create a new port right here, for example,.

D

B

D

What I mean that, uh as long as the point, not the details, the the the the the empty actually exists right.

C

Yes, but if you just change configmap or you do, if you do any update to the port or upgrade the port, it's actually a port deletion right, then the neopod needs to create a new csr.

C

Okay, the case you are talking about should be the uh port before it should be the container restart case, not a portrait style. Actually, pod doesn't really restart, for example, the android agent crash process crash, and only that container is restarted.

C

I think only in that way, the empty volume is still there.

D

Anyway, but you're saying um in upgraded case, it will be a new port.

C

Okay, yes, yes,.

D

Yes, it should be okay to post it.

A

uh I did have one question: can you go back to the r back uh slide? Please? Oh yeah yeah this one. So for the uh it seems that, on the sorry I was looking yeah uh when it comes to the certificate signing request, so the controller can can approve.

A

It can can update all of them not only the ones, uh not not this entry. The entry about that.

A

For a certificate, signing requests.

A

A

I guess I'm trying to understand the difference between I'm trying to understand what designers resources um the one below sorry um the signers resource. Is it like uh who's, creating that resource.

B

Yeah so so I think I think uh so this is this is the standard drawback for for all kind of series. Yeah. We have sub resource for approval and status, but we still need a additional uh verbs for the for the for the scanner, so uh so this this means that the android controller can only sign and approve uh csrs with the specific server name.

A

Okay, so it's kind of like a specific resource. It doesn't really exist in.

C

A

And is there a way for the entry agent? Is there a way to constrain what kind of certificate signing request an agent can create.

A

I don't know if it's a security issue, but ideally you would only want to be able to create certificate, signing requests for the entry at the dot, io signer, and I guess ideally you would be able to constrain what you can put in the in the common name, field or san san field. But I I guess it's not possible because all the entry agent pods in the domain set of the same permissions.

B

Yeah yeah yeah you're right for I think for create requests. We cannot, we cannot get. We cannot set conspiracy for for the resource.

D

And tell me: what's uh what's the issue you saw here.

A

uh I was, I was just thinking that those permissions were a bit permissive because you can create certificate, signing requests for other approvers. I don't know if that's an issue, but I'm just thinking of a case where a node is compromised and the agent token is is compromised.

A

You know we have a discussion in the past about privilege escalation.

A

If the agent token is compromised- and I was wondering if this is if this is considered- like a um an important permission- the ability to create csrs for or if it's not really considered, like a dangerous permission to have.

B

I can't uh check this later to get to see whether we can set contrast for the integration for for the creating of csrs.

B

D

That's a valid.

B

D

The controller proves the csr request: do you have a way to validate the com name.

B

Yes, yeah so yeah, so I think for for our center, we need to make sure uh the company, the content section, is valid and we can also check to make sure the node uh exists and also we can check the the substrate total name section, and we can also check for the usages.

A

You don't know who created the certificate request, so it can. It can be any node right because all the agents they use the same token to talk to the community's apis. So I mean once the csr resource is created, you don't know who created it, which node created it. Yeah yeah.

B

Yeah, so we we yeah. No, no, we don't know, we don't know uh which node creates the csr, but we can make sure that we we don't. We will not sign requests for the north carolina which that does exist in the class.

B

C

Does other integration typically upload the csr manually by user.

C

From this message it says automatically approve and shadow io signup. Then perhaps there is another way to ask user to upload this csr.

C

Not sure it's typical to always automatically approve it by program, it sounds like uh every node actually has can have all peer certificates and keys if they want, because even uh even when one agent can create its own ssr and get gets its certificate. Another compromise, the agent may issue same request and this gets certificated.

C

I'm not sure whether this is a security issue, but uh yes, perhaps if we or just optionally have a configuration to ask a user to upload the csr when they start the uh when they deploy after they deploy and share, could that be an option and could that avoid the issues, security issues by automatic approval yeah? I think that's a.

B

That's uh that's a good strategic suggestion, so I think we can disable the the automatically approved for from a android controller so so badly. Also, we can ask for the users to approve the csrs.

B

But but the problem is that for for node, reboots or or centrosis variation, so we might need also users to manually pull the csrs.

B

That might be a.

C

Subtle issue yeah. I think that's understandable, because we, if we document that the certificate will not be will not be persistent across, not restart. It should be reasonable to ask a user to re-upload new csr after a node restarts- and I remember cube control manager. Has this option to uh to I remember by default by default. It doesn't automatically upload csr.

C

It will only do that after you enable auto upload option, so it sounds like it by default. It's safe but hard to use, but if you want to delegate the permission to to to the program it can always it can be configured. So perhaps we could follow the same way.

A

What does cube controller manager uh sign csrs for the design csrs for cubelets, individual cubelets or yeah? Do you know.

C

I'm not sure which which it is for, but I I know there's an option. Okay,.

A

I think that's a good idea, but do you do you think it's possible to prevent pods from being scheduled on a node until the csr has been approved? I'm just thinking of a node reboot, where the node would reboot and pod would be scheduled to the to the node, but they would not be able to talk to other pods on different nodes until the csr is approved. So would there be a way for us to mark the node that not that's not ready or something like this or unscheduled, or something like this?

A

Does that make sense or.

C

Yeah, I think we can all always update node status to I know some other clients do report their own status to node status and then mark the node as not already.

D

C

If we have the permission to update the node status, I think that's that's possible.

B

Yeah that stands up for the idea here. Thank you.

D

I have another question: uh it's common name. You mean it's called name, just a node name right.

B

um Yeah, actually, we can change it to whatever we want, but it it must match the the the part confusions of the also obvious bridge it must. It must match the remote name here.

D

But that doesn't mean the dns name. Wasn't known right: how? How could you, how could you know you validated the certificate if the com name just know them, um I mean you: don't have ip or dns name in the certificate.

B

I think it's, I think it's it's just valid as a common name matches the the remote name.

D

Oh with an mvc.

B

D

Okay, you mean openly switches to that one.

B

D

D

A

All right: well, I think that was a very comprehensive presentation, thanks to um and anyone else has any follow-up question on this topic.

A

All right, uh thanks again to I think that is all we add on the agenda. So now is a good time uh to speak up. If there is any other topic, you wanna you wanna bring up uh to today's meeting or any status update. You wanna share.

A

Okay looks like there is no new topic, in which case everyone's going to get 15 minutes back um thanks everyone for joining the meeting tonight, and thanks again to you for your ipsec certificate presentation, I'm sure we can follow up the discussion online.

A

Have a good one, everyone and I'll catch you in two weeks.

B