Comments (3)
I am assuming behind the scenes somewhere k0sctl uses tokens for node registration.
K0sctl uses k0s's own mechanism to create join tokens for additional nodes.
- For each additional node k0sctl generates a join token using
k0s token create --role=XX --expiry 10m
on the first controller node. - This token is copied to the other node's
/etc/k0s/k0stoken
. - K0s is installed and started on the other node, which will use the join token for authenticating the node to the k0s/k8s cluster.
- Once the node has joined the cluster, k0sctl uses
k0s token invalidate
to invalidate the token and removes the key from/etc/k0s/k0stoken
as it is not needed anymore. This will also be done if the installation fails to avoid leaving behind unused tokens.
If a control plane is compromised, will that mean all the SSH keys to worker nodes will be compromised ??
The nodes in your cluster don't require SSH access to each other. K0sctl is primarily used from your workstation or a deployment system and isn't actually installed on the cluster itself. It's intended for use by individuals or systems with administrative-level SSH access to the nodes. K0s doesn't need or utilize k0sctl and you don't need k0sctl to manage k0s – it's a separate optional utility for simplified k0s deployments.
SSH Access: The tool needs SSH access to the nodes. If the SSH keys or credentials are mishandled or stored insecurely, unauthorized users could gain access to your nodes.
This principle applies universally to systems with any form of authentication. Avoid mishandling or insecure storage of credentials.
Permission Level: Typically, administrative or root-level access is required to perform many of the operations. If an attacker gains control of the tool or the system where it's run, they could potentially execute arbitrary commands on your nodes.
Using passphrase-encrypted SSH keys adds an extra layer of protection against potential breach if your local system were to be compromised.
Man-in-the-Middle Attacks: If SSH is not configured to use strong encryption and authentication, there could be potential for man-in-the-middle attacks, where an attacker intercepts and possibly alters the communication between the tool and the nodes.
Lack of Network Segmentation: If SSH is open to the world and not restricted to specific IP addresses or networks, it increases the attack surface.
Automation Risks: Automated tools that perform complex tasks can sometimes introduce unexpected security holes, depending on how they are configured and used.
Are the above concerns handled by k0sctl behind the scenes?
Configuring SSH and network security falls outside k0sctl's scope.
from k0sctl.
Hi
@twz123 thank you for assigning the right labels.
@kke Thank you very much for clarifications. It explains a lot clearly of whats happening in background.
Once the node has joined the cluster, k0sctl uses k0s token invalidate to invalidate the token and removes the key from /etc/k0s/k0stoken as it is not needed anymore. This will also be done if the installation fails to avoid leaving behind unused tokens.
I just have 1 question left. So if the token is invalidated. Say in future, If the node changed its Ip address due to some reason. Will that node still be able to register itself with the control plane. I am specifically looking for node registration for nodes that can have dynamic IP.
from k0sctl.
After the initial join, the workers continue to communicate with the cluster using x509 client certificates through the kube api. The controllers do not directly communicate with the workers.
In kubelet there's:
--hostname-override string
If non-empty, will use this string as identification instead of the actual hostname. If--cloud-provider
is set, the cloud provider determines the name of the node (consult cloud provider documentation to determine if and how the hostname is used).
K0sctl already validates that every node has a unique hostname, so I think it may just work even without --cloud-provider
, but I'm not sure, as k0sctl does set the --node-ip
when joining workers:
--node-ip string
IP address (or comma-separated dual-stack IP addresses) of the node. If unset, kubelet will use the node's default IPv4 address, if any, or its default IPv6 address if it has no IPv4 addresses. You can pass '::' to make it prefer the default IPv6 address rather than the default IPv4 address.
Anyway, just recording api communication and reusing an existing worker's IP won't allow a rogue node to communicate with the control plane, as it needs the client cert private key from the real worker.
from k0sctl.
Related Issues (20)
- Unable to upload files to `/etc/k0s/containerd.d/` HOT 7
- Traefik and TCP (non-http/s) on k0sctl HOT 3
- k0sctl init doesn't come to a working cluster HOT 5
- AWS classic LB in front of master nodes is not working
- Install worker phase tries too little
- Multi controller install fails on OL9 HOT 8
- Wrong private network interface fails validation during k0s upgrade HOT 4
- CoreDNS patch
- When passing in the k0s version to k0sctl, as a user I want to be told I passed in an invalid k0s version
- Extra \x20 in the service file HOT 3
- Cluster Initialization fails at the 'Download k0s on host' phase HOT 4
- Error copying files to remote - k0sctl 0.17.4 HOT 4
- File upload does not work with directories with ":" in their names HOT 2
- Worker upgrading seems to cordon all the nodes at once HOT 1
- Host names are not normalized into node names HOT 2
- v0.17.5 can't connect to a single host config HOT 6
- k0sctl kubeconfig outputs failed to locate configuration HOT 4
- How to disable telemetry? HOT 2
- Allow disabling update check at build-time HOT 1
- Upgrade fails when /tmp is mounted with noexec HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from k0sctl.