gce: verify MIG membership in the TPM verifier - #18583
Conversation
Pure refactor: move the created-by / MIG membership / instance template resolution out of the node identifier into GetInstanceTemplateForMIGMember, so it can be reused by the GCE TPM verifier. No behavior change.
ListManagedInstances only needs the MIG name and zone, which are already known at the call site, so the Get was a wasted API round-trip.
FindMachineByProviderID listed Machines cluster-wide, so a Machine from another CAPI cluster in the same management cluster could match. Filter by spec.clusterName; both GCE callers pass the escaped cluster name.
Reject requests with an invalid signature before fetching the instance, so unauthenticated requests cost a single API call. Also drop a %w verb that always formatted a nil error.
The TPM signature proves control of a Shielded VM in the project, but the cluster and instance group were read from instance metadata, which is settable by whoever creates a VM, so it cannot prove cluster membership. Verify that the instance is managed by a MIG and read the cluster name and instance group name from its instance template, as the node identifier already does.
kubernetes-prow
Bot
added
area/provider/gcp
|
/assign @justinsb |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@hakman: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
The GCE TPM verifier read
cluster-nameandkops-k8s-io-instance-group-namefrom live instance metadata, which is set by whoever creates the VM. The TPM signature only proves control of some Shielded VM in the project, so anyone withcompute.instances.createcould bootstrap a rogue node into the cluster.Do what the node identifier in
pkg/nodeidentity/gcealready does: confirm the instance is actually managed by the MIG named in itscreated-bymetadata and read the cluster name and instance group name from the MIG's instance template, which cannot be changed without GCE API access. The logic is extracted into a shared helper used by both.Also: CAPI Machines are now matched only from the given cluster, the TPM signature is checked before any other API calls, and a redundant
InstanceGroupManagers.Getcall is dropped. No new IAM permissions; kops-controller already makes these calls when identifying nodes./cc @rifelpet @justinsb