search

kelseyhightower / vault-controller

Automate the creation of unique Vault tokens for Kubernetes Pods using init containers.
Apache License 2.0
447 stars 69 forks source link

Document the Trust model #5

Open kelseyhightower opened 7 years ago

kelseyhightower commented 7 years ago

It's not clear from the docs that we are trusting the network on step 4 of the token request flow. We are subject to MitM attacks on the response from the vault-controller back to the init-container. The wrapped token can be unwrapped by an untrusted 3rd party so we must set a timeout or raise an alarm so it can be tracked in the vault audit logs.

Albibek commented 7 years ago

Regarding the timeout issue: Vault has the NumUses seting in TokenCreateRequest structure. Setting this to 1 allows to be more alertful for wrapped token steals.

I wlse see the easy solution to avoid this problem at all: public-key cryptography, be it RSA or whatever. Vault-init could generate a keypair providing the public key to vault-controller, so controller was able to answer with encrypted message. Also the Vault transit backend can be used for the same purpose, but it seems harder to implement, since correct policies need to be set up first.

anshumanbh commented 7 years ago

@kelseyhightower do you think the cubbyhole approach from Vault could be used to avoid the MiTM attack? - https://www.vaultproject.io/docs/concepts/response-wrapping.html