News for hackers. Stuff that matters.

A comment on Kubernetes Enthusiasts: Share Your Ideas for Future Dev Tools.

Re:Kubernetes Enthusiasts: Share Your Ideas for Future Dev T... by simiones on Wednesday May 24, 2023 @11:06AM (#36059175)
One thing I just hit is that there doesn't seem to be any way to ask from a Pod to get a TLS certificate signed by the cluster itself (that would only be valid inside the cluster, of course) that is valid for the IP(s) and DNS names associated by Kubernetes itself with the pod (and to automatically rotate etc such certs).

Since the infrastructure already knows (and controls) this information, it would be the ideal place to actually generate a signed attestation that a pod is who it says it is.

[ Parent | on HN ]
Re:Kubernetes Enthusiasts: Share Your Ideas for Future Dev T... by epilogue on Wednesday May 24, 2023 @11:34AM (#36059548)
We’ve been using Linkerd as our service mesh which does this without really much effort at all required on our part. They bind the certs to the ServiceAccount identity of each pod, which is apparently more secure than doing it via IP.

https://linkerd.io/2.13/features/automatic-mtls/

[ Parent | on HN ]
Re:Kubernetes Enthusiasts: Share Your Ideas for Future Dev T... by simiones on Thursday May 25, 2023 @05:02AM (#36068482)
Unfortunately this would probably not work for my purposes - the issue on my side is that I want to enable MinIO to use server-side encryption; however, MinIO doesn't support SSE unless TLS is enabled inside MinIO itself - so it's ultimately MinIO that needs these certificates, it doesn't help that the Linkerd proxy is actually encrypting the traffic if MinIO doesn't know about it.

There may be a way to tell MinIO to use the the proxy certificates though, since those may be somewhere in the pod FS if I understand the docs correctly, I can try to investigate that, thanks for the link!

[ Parent | on HN ]
Re:Kubernetes Enthusiasts: Share Your Ideas for Future Dev T... by hosh on Wednesday May 24, 2023 @11:35AM (#36059574)
Couldn’t do this with cert-manager or maybe one of the service meshes?
[ Parent | on HN ]
Re:Kubernetes Enthusiasts: Share Your Ideas for Future Dev T... by simiones on Thursday May 25, 2023 @05:03AM (#36068489)
Reading through their docs, it seems cert-manager should support this, but unfortunately it wasn't available in our cluster. I'll see if there is any reason we couldn't add it.
[ Parent | on HN ]