Cloud Native Computing Foundation KubeCon + CloudNativeCon Europe 2018 (Copenhagen), 14 Nov 2015

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Lightning Talk: I Got your RBAC - kube-rbac-proxy - Frederic Branczyk, CoreOS (Any Skill Level)

Description

Want to view more sessions and keep the conversations going? Join us for KubeCon + CloudNativeCon North America in Seattle, December 11 - 13, 2018 (http://bit.ly/KCCNCNA18) or in Shanghai, November 14-15 (http://bit.ly/kccncchina18).

Lightning Talk: I Got your RBAC - kube-rbac-proxy - Frederic Branczyk, CoreOS (Any Skill Level)

Kubernetes RBAC is great for authorizing requests to the Kubernetes API, and is a vital component for a secure Kubernetes cluster. Wouldn't it be great to use RBAC to authorize requests to your applications as well? In this lighting talk, Frederic will showcase kube-rbac-proxy, the tool he developed just for this use case. While operating his own Kubernetes cluster, the need came about to protect applications that don't have native authentication and authorization means to utilize the methods available by Kubernetes.

About Frederic
Frederic is an engineer at CoreOS contributing to Prometheus and Kubernetes to build state of the art modern infrastructure and monitoring tools. He discovered his interest in monitoring tools and distributed systems in his previous jobs, where he used machine learning to detect anomalies indicating intrusion attempts. He also worked on projects involving secrets management for distributed applications to build sane and stable infrastructure.
Join us for KubeCon + CloudNativeCon in Barcelona May 20 - 23, Shanghai June 24 - 26, and San Diego November 18 - 21! Learn more at https://kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy and all of the other CNCF-hosted projects.

A

So I have a lot of content and a very short amount of time. So what I'm going to be talking about today is something that is very concerning for the work that I do so I work on Prometheus, just like Galton, and we ship that to our customers. So it has to be really really secure and that's that's a problem because in the Prometheus world we just say security. Is your your your job?

A

We don't care about it, you do it so, but when I sell those customers it needs to be secure and when Prometheus scrapes, all of these metrics they made might have sensitive information. So, for example, the node exporter that we have exposes the kernel version, which obviously for an intruder, would be quite interesting for further exploitation.

A

So how do we make sure that only prometheus can access this and obviously we need some sort of authentication and authorization mechanism and I looked at how some of the examples within kubernetes already do this and it turns out the API server and the coop that already do the stands, that I basically want to copy. So the couplet, whenever I as Prometheus, requests metrics from the couplet, it verifies that I'm actually Prometheus.

A

So that's the authentication part and is that it does that by either a client certificate or a service account token, and then the authorization part is what we all know. As our back and the specific API call it, as here is called the subject, access review.

A

So the way that then works in the coop are back proxy, which is the project that I am presenting here. Is that it sits in front of my application that serves the metrics and it does this. So this example is with the service account token. So the token review API is to verify that this is actually a user that exists and then I get the user, ID information and my proxy and then I ask.

A

Is this user allowed to access this information and when I get back that it is indeed allowed to then I actually proxy? This request and Prometheus gets all these metrics, so authorization can look to like two things, so one is resource based. So when we talk about actual resources in kubernetes, so can I access a service or an on resource URL, which is just like any any URL and, as it happens, the metrics endpoint thoughts into this or something interesting. What some help people are actually doing is using this to authenticate how helm requests.

A

So let me give you a quick demo of this, so I have a deployment of the coop erect proxy and it needs to do the token review and the subject access review and is configured with a config map and, as we can see here, I'm authenticating, based on a resource and I'm checking whether prometheus is allowed or though whatever the requesting entity is whether that entity is allowed to proxy through that service.

A

So this could also be used for user user facing applications, but we'll get to that later and then in the deployment I just do some normal setup of any any proxy really. So let me go ahead and deploy that.

A

And we have that up and running and now I also create my client, which is just an Ubuntu container, that I'm starting and now exact into that.

A

So I'm now in there and.

A

A

Hand, paint and I get unauthorized because I haven't even presented. My service account token, so it says I'm not even authenticated, so I do that and I get forbidden because I don't actually have the I'm not allowed to access this, but if I give it the actual permissions which we can see here that.

A

I'm giving my service now services, yet services, slash proxy, because that's the sub resource that I required to have and when I do that.

A

And run this again, I am actually allowed to access this, so within my last 15 seconds. So some future work includes using the token review API.

A

So right now, it's actually not super secure to use the service account tokens because the token can be used to impersonate the requesting entity and with with the token request API, you can specify an audience, so it can be used to authenticate against the API server, for example, some and some unprivileged access reviews so that my entity doesn't actually need any are back for this and human authentication mechanisms like orth or OAD c, because only machine authentication is possible J. Thank you.