3 ms·

What about PKI? I ran a decent size K8s cluster for a while and proper PKI was a pretty important thing IMHO. Everything running in a K8s environment supports P

What about PKI? I ran a decent size K8s cluster for a while and proper PKI was a pretty important thing IMHO. Everything running in a K8s environment supports PKI (roots, intermediates, client / server cn / rbac verification, etc) and there's no excuse to set things up properly when tools like cfssl exist and can be automated in deployment pipelines. Edit: CRL[0] and OCSP(maybe?) appear to be coming soon. 0: https://github.com/kubernetes/kubernetes/issues/18982 https://github.com/kubernetes/kubernetes/issues/18982

kiallmacinnes 8y ago
CRL and OSCP have been asked for for a very long time! I don't see them coming anytime soon. The golang TLS library author has a thing against them, so chose to not implement them[0]. Personally, I think he's wrong. He's describing a web browser style use case and not an internally managed CA for a single specific service, and he's then applied that reasoning to a languages TLS library. And it's left essentially all TLS in golang without revocation support. For Kubernetes, you'll need to wire up nginx/haproxy whatever in front of every endpoint to do TLS+CRL checks before handing off the connection to the actual backend (kube-api, kubelet, etc) over 127.0.0.1 (still with SSL! Lookback is not safe when untrusted code is running on your server..). [0]: https://www.imperialviolet.org/2014/04/19/revchecking.html https://www.imperialviolet.org/2014/04/19/revchecking.html