All remote resources should be fetched over HTTPS about kubernetes HOT 10 CLOSED

@kseifriedredhat Totally agree -- can you point to stuff as you see it and we'll fix it up. Or send a PR.

Thanks!

from kubernetes.

Just grep the source, so for example:

./kubernetes-master/cluster/saltbase/salt/kube-proxy/default:DAEMON_ARGS="$DAEMON_ARGS
--etcd_servers=http://{{ ips[0][0] }}:4001"
./kubernetes-master/cluster/saltbase/salt/kubelet/default:DAEMON_ARGS="$DAEMON_ARGS
-etcd_servers=http://{{ ips[0][0] }}:4001 -address=$HOSTNAME"
./kubernetes-master/cluster/saltbase/salt/apiserver/default:DAEMON_ARGS="$DAEMON_ARGS
-etcd_servers=http://{{ ips[0][0] }}:4001"
./kubernetes-master/cluster/saltbase/salt/controller-manager/default:DAEMON_ARGS="$DAEMON_ARGS
-etcd_servers=http://{{ ips[0][0] }}:4001"

from kubernetes.

Those are all intra-cluster communication. In the typical deployment none of those would be going over a WAN link. While ideally that stuff would be over TLS also, distributing key material in a secure way becomes difficult in an automated way.

I'd prioritize places where we grab resources over the internet over securing intra-cluster communication.

from kubernetes.

I filed #129 to track intra-cluster communication.

from kubernetes.

Is this meant to now refer to communication from the client rather than from the node components? If not, then it and #129 are covering the same thing and this should be closed.

from kubernetes.

If you replace all these with TLS via #129 then yes, that would cover this. Does your documentation specifically state that the intra cluster nodes need to have a trusted network, becauce if not this should probably be given a CVE.

from kubernetes.

TODO: audit code for all usage of http instead of https and file separate issues for each non-benign one. E.g. apiserver to same machine etcd is fine via http.

from kubernetes.

This audit was done and reported in #129

from kubernetes.

I did a quick audit of the cluster/ directory to see where I could find places that we are fetching resources over the internet and found the following:

In build scripts (Makefiles / Dockerfiles):

1. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/images/hyperkube/Makefile#L6
2. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/fluentd-es-image/Dockerfile#L24
3. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/kibana-image/Dockerfile#L13
4. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/images/nginx/backports.list#L1

In cluster initialization scripts:

1. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/gce/configure-vm.sh#L295-L296
2. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/libvirt-coreos/util.sh#L120
3. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/rackspace/cloud-config/master-cloud-config.yaml#L121

from kubernetes.

The intra-cluster audit was covered in #129 and I've done an audit over cluster initialization scripts here and sent PRs to fix a couple of easy cases and filed separate bugs for the remaining occurrences. Marking this issue as fixed.

from kubernetes.