All remote resources should be fetched over HTTPS

[ghost]

There's a whole lot of stuff being downloaded/connected to over HTTP instead of HTTPS, this should be either configurable or ideally done via HTTPS by default.

[jbeda]

@kseifriedredhat Totally agree -- can you point to stuff as you see it and we'll fix it up. Or send a PR.

Thanks!

[ghost]

Just grep the source, so for example:

./kubernetes-master/cluster/saltbase/salt/kube-proxy/default:DAEMON_ARGS="$DAEMON_ARGS
--etcd_servers=http://{{ ips[0][0] }}:4001"
./kubernetes-master/cluster/saltbase/salt/kubelet/default:DAEMON_ARGS="$DAEMON_ARGS
-etcd_servers=http://{{ ips[0][0] }}:4001 -address=$HOSTNAME"
./kubernetes-master/cluster/saltbase/salt/apiserver/default:DAEMON_ARGS="$DAEMON_ARGS
-etcd_servers=http://{{ ips[0][0] }}:4001"
./kubernetes-master/cluster/saltbase/salt/controller-manager/default:DAEMON_ARGS="$DAEMON_ARGS
-etcd_servers=http://{{ ips[0][0] }}:4001"

[jbeda]

Those are all intra-cluster communication. In the typical deployment none of those would be going over a WAN link. While ideally that stuff would be over TLS also, distributing key material in a secure way becomes difficult in an automated way.

I'd prioritize places where we grab resources over the internet over securing intra-cluster communication.

[jbeda]

I filed #129 to track intra-cluster communication.

[a-robinson]

Is this meant to now refer to communication from the client rather than from the node components? If not, then it and #129 are covering the same thing and this should be closed.

[ghost]

If you replace all these with TLS via #129 then yes, that would cover this. Does your documentation specifically state that the intra cluster nodes need to have a trusted network, becauce if not this should probably be given a CVE.

[alex-mohr]

TODO: audit code for all usage of http instead of https and file separate issues for each non-benign one. E.g. apiserver to same machine etcd is fine via http.

[erictune]

This audit was done and reported in #129

[roberthbailey]

I did a quick audit of the cluster/ directory to see where I could find places that we are fetching resources over the internet and found the following:

In build scripts (Makefiles / Dockerfiles):

1. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/images/hyperkube/Makefile#L6
2. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/fluentd-es-image/Dockerfile#L24
3. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/addons/fluentd-elasticsearch/kibana-image/Dockerfile#L13
4. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/images/nginx/backports.list#L1

In cluster initialization scripts:

1. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/gce/configure-vm.sh#L295-L296
2. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/libvirt-coreos/util.sh#L120
3. https://github.com/GoogleCloudPlatform/kubernetes/blob/master/cluster/rackspace/cloud-config/master-cloud-config.yaml#L121

[roberthbailey]

The intra-cluster audit was covered in #129 and I've done an audit over cluster initialization scripts here and sent PRs to fix a couple of easy cases and filed separate bugs for the remaining occurrences. Marking this issue as fixed.