cnti-testcatalog / testsuite

📞📱☎️📡🌐 Cloud Native Telecom Initiative (CNTI) Test Catalog is a tool to check for and provide feedback on the use of K8s + cloud native best practices in networking applications and platforms
https://wiki.lfnetworking.org/display/LN/Test+Catalog
Apache License 2.0
169 stars 70 forks source link

Test: Verify if configmaps are encrypted #1996

Open haskojur opened 2 months ago

haskojur commented 2 months ago

Description

By default in kubernetes system, encrypting of data inside object like configmaps is not enabled, so data in etcd are available for potential attacker. Encrypting of configmaps is possible in newer versions of kubernetes. When this configuration is done, all newly created configmaps has encrypted data in etcd key-value store. This testcase creates new sonfigmap with random suffix (to avoid confilct). Then we will use similar command in etcd pod to verify if encryption is working: ETCDCTL_API=3 etcdctl \ --cacert=/etc/kubernetes/pki/etcd/ca.crt \ --cert=/etc/kubernetes/pki/etcd/server.crt \ --key=/etc/kubernetes/pki/etcd/server.key \ get /registry/configmaps/default/my-configmap | hexdump -C

Issues:

Refs: #1994

How has this been tested:

Types of changes:

Checklist:

Documentation

Code Review

Issue

haskojur commented 2 months ago

@HashNuke can you give me a feedback for this one please? :)