Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement token auth for cp/dp connections #380

Closed
kate-osborn opened this issue Jan 17, 2023 · 0 comments
Closed

Implement token auth for cp/dp connections #380

kate-osborn opened this issue Jan 17, 2023 · 0 comments
Labels
backlog Currently unprioritized work. May change with user feedback or as the product progresses. enhancement New feature or request

Comments

@kate-osborn
Copy link
Contributor

kate-osborn commented Jan 17, 2023

Parent issue: #292

The data plane should authenticate with the control plane upon connection using a long-lived Kubernetes token. The control plane should verify the token using Kubernetes TokenReview API. For more information, see https://github.com/nginxinc/nginx-kubernetes-gateway/blob/main/design/control-data-plane-separation/design.md#authorization.

A/C:

  • The data plane agent attaches its long-lived Kubernetes Service Account Token to its connection request to the control plane
  • The control plane verifies that the agent's token is valid and corresponds to the expected Kubernetes Service account
  • If the token is not valid, the control plane does not register the agent and returns an error
  • If the token is valid, the control plane allows the agent to register

Aha! Link: https://nginx.aha.io/features/NKG-38

@mpstefan mpstefan added enhancement New feature or request and removed proposal labels Jun 9, 2023
@mpstefan mpstefan added the backlog Currently unprioritized work. May change with user feedback or as the product progresses. label Jul 20, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
backlog Currently unprioritized work. May change with user feedback or as the product progresses. enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants