Spiffe support - Githubissues

kubernetes-sigs / node-feature-discovery

Node feature discovery for Kubernetes

Apache License 2.0

754 stars 236 forks source link

Spiffe support #1186

Open marquiz opened 1 year ago

marquiz commented 1 year ago

What would you like to be added:

Support SPIFFE for verifying nfd-worker/labeler IDs. For example, utilize spiffe IDs for verifying the identity of creator of NodeFeature objects, so that an actor from node A will not be able to modify properties of node B. This would also add one extra layer of protection (in addition to RBAC) on who is authorized to modify nodes with NodeFeature objects.

To simplify, gRPC could be possibly left out-of-scope, if needed, as it's being phased out.

Inspired by comment from @AhmedGrati on the node-feature-discovery slack channel.

Why is this needed:

Improved security

AhmedGrati commented 1 year ago

/assign

k8s-triage-robot commented 7 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

AhmedGrati commented 7 months ago

/remove-lifecycle stale

ArangoGutierrez commented 7 months ago

Only comment, is make sure is optional and easy to enable/disable from HELM

AhmedGrati commented 7 months ago

@ArangoGutierrez yes that's for sure!

TessaIO commented 4 months ago