tg123/sshpiper

Cache private keys for upstream servers from Kubernetes

vholer opened this issue · 1 comments

vholer commented

When public key authenticated session is being estabilished from downstream to sshpiper, the Kubernetes control plane is not directly queried, as the Kubernetes client in sshpiper listens to the changes in Pipe CRDs and fetches/caches them as they happen. After that, when second connection is being established from sshpiper to final upstream server, the sshpiper always fetches the fresh SSH private key.

It might be nice to have an (switchable) option to listen/cache these SSH private key Secrets as well.

sshpiper/plugin/kubernetes/kubernetes.go

Line 166 in 212ea32

secret, err := p.k8sclient.Secrets(pipe.Namespace).Get(context.Background(), to.PrivateKeySecret.Name, metav1.GetOptions{})

USE CASE:

  • valid, but malicious, user might try to DoS Kubernetes control plane by logging in a loop
  • Kubernetes control plane maintenance/upgrade makes the service unavailable
tg123 commented

i remember why i did not use lister/cacher for secrets. it is to restrict access to get within same ns only

https://kubernetes.io/docs/concepts/security/secrets-good-practices/#least-privilege-secrets