Implement token auth for cp/dp connections #380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

kate-osborn opened this issue Jan 17, 2023 · 0 comments

Labels

backlog enhancement

Contributor

kate-osborn commented Jan 17, 2023 •

edited by brianehlert

Loading

Parent issue: #292

The data plane should authenticate with the control plane upon connection using a long-lived Kubernetes token. The control plane should verify the token using Kubernetes TokenReview API. For more information, see https://github.com/nginxinc/nginx-kubernetes-gateway/blob/main/design/control-data-plane-separation/design.md#authorization.

A/C:

The data plane agent attaches its long-lived Kubernetes Service Account Token to its connection request to the control plane
The control plane verifies that the agent's token is valid and corresponds to the expected Kubernetes Service account
If the token is not valid, the control plane does not register the agent and returns an error
If the token is valid, the control plane allows the agent to register

Aha! Link: https://nginx.aha.io/features/NKG-38

kate-osborn added the proposal label

kate-osborn mentioned this issue

Separate control and data planes #292

Closed

mpstefan added enhancement and removed proposal labels

mpstefan added the backlog label

kate-osborn closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment