Revision cb6a58bef00b40084392774de0a6bc0602c6daec authored by Marco Iorio on 11 June 2024, 09:43:48 UTC, committed by André Martins on 13 June 2024, 13:01:41 UTC
Currently, the same etcd user (i.e., remote) is granted permissions to read the whole content of the clustermesh-apiserver's sidecar etcd instance, including also the data cached by kvstoremesh, when enabled. In an effort to harden the overall clustermesh posture, let's introduce a separate and dedicated user for local access, to ensure that remote clusters cannot access cached data, as it may include information that they would not normally have access to. Specifically, the remote user is intended to have access only to the information regarding the local cluster, while the local user can access cached data about remote clusters only. Still, for backward compatibility purposes, the remote user still retains access to cached data as well in this release. The reason being that there would otherwise be a time window upon upgrade in which Cilium Agents would lose access to the kvstoremesh data (especially in large clusters). Indeed, the new certificate would be mounted by the agents only upon rollout, but the configuration would be immediately reloaded (thus targeting the new, not yet mounted, certificate), hence breaking the access to the information cached by kvstoremesh. Signed-off-by: Marco Iorio <marco.iorio@isovalent.com>
1 parent 22bab80
File | Mode | Size |
---|---|---|
.gitignore | -rw-r--r-- | 5 bytes |
custom-boilerplate.go.txt | -rw-r--r-- | 71 bytes |
spdx-copyright-header.txt | -rw-r--r-- | 63 bytes |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...