Secure the client/server communication between ReST client and ReST server
Kubernetes uses TLS in some way to secure the ReST API endpoint . The documentation points to using nginx to secure the apiserver ReST API. Ideally we would sort out how to secure the ReST API using TLS and possibly nginx (this may require changes to the heat template for launching atomic).
Blueprint information
- Status:
- Complete
- Approver:
- Adrian Otto
- Priority:
- Essential
- Drafter:
- Steven Dake
- Direction:
- Approved
- Assignee:
- Madhuri Kumari
- Definition:
- Approved
- Series goal:
- Accepted for liberty
- Implementation:
-
Implemented
- Milestone target:
-
liberty-2
- Started by
- Madhuri Kumari
- Completed by
- Adrian Otto
Related branches
Related bugs
Sprints
Whiteboard
T-Shirt sizing: M (may change after getting more details)
Specification Wiki: https:/
Cookbook for TLS certificate handling: https:/
Consider looking at Docker Machine as a working example of how to implement this:
https:/
My understanding of how Docker-Machine works:
1) The client generates an ssh key pair, and supplies the public key to the nova create API call.
2) The client generates all the TLS certificates and keys.
3) The client uses an ssh connection to the server to put the server's TLS keys to configure the docker daemon on the nova instance.
4) The local docker client is configured to make secured TLS communication with the remote docker server.
Gerrit topic: https:/
Addressed by: https:/
Add TLS support in Magnum.
Addressed by: https:/
Add TLS support in heat kubernetes template
Addressed by: https:/
Add TLS support in heat kubernetes template for Ironic
Addressed by: https:/
[WIP] Add Cert controller and handler.
Addressed by: https:/
Add Cert controller and conductor.
Addressed by: https:/
Add context to TemplateDefinit
Addressed by: https:/
Split TemplateDefinit
Addressed by: https:/
[WIP] Register client cert from k8s master node to Magnum
Addressed by: https:/
[WIP] Add get_magnum_url method to clients module
Addressed by: https:/
Add guide for TLS support in Magnum.
Gerrit topic: https:/
Addressed by: https:/
Make Kubernetes API call secure.
Addressed by: https:/
[WIP] Add a tool to manage x509 objects
Addressed by: https:/
[WIP] Add CA controller for TLS support.
Gerrit topic: https:/
Addressed by: https:/
Make bay.api_address contains protocol
Addressed by: https:/
Fix calling parameter at get_cert/
Addressed by: https:/
Allow unicode text as CSR
Addressed by: https:/
Added a guide to explain how to use secure Kubernetes API
Work Items
Dependency tree
* Blueprints in grey have been implemented.
