This repository has been archived by the owner on Feb 28, 2024. It is now read-only.
/
kube.go
148 lines (129 loc) · 4.43 KB
/
kube.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
/*
Copyright 2018-2019 Gravitational, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package auth
import (
"time"
"github.com/gravitational/teleport"
"github.com/gravitational/teleport/lib/defaults"
"github.com/gravitational/teleport/lib/modules"
"github.com/gravitational/teleport/lib/services"
"github.com/gravitational/teleport/lib/tlsca"
"github.com/gravitational/trace"
)
// KubeCSR is a kubernetes CSR request
type KubeCSR struct {
// Username of user's certificate
Username string `json:"username"`
// ClusterName is a name of the target cluster to generate certificate for
ClusterName string `json:"cluster_name"`
// CSR is a kubernetes CSR
CSR []byte `json:"csr"`
}
// CheckAndSetDefaults checks and sets defaults
func (a *KubeCSR) CheckAndSetDefaults() error {
if len(a.CSR) == 0 {
return trace.BadParameter("missing parameter 'csr'")
}
return nil
}
// KubeCSRResponse is a response to kubernetes CSR request
type KubeCSRResponse struct {
// Cert is a signed certificate PEM block
Cert []byte `json:"cert"`
// CertAuthorities is a list of PEM block with trusted cert authorities
CertAuthorities [][]byte `json:"cert_authorities"`
// TargetAddr is an optional target address
// of the kubernetes API server that can be set
// in the kubeconfig
TargetAddr string `json:"target_addr"`
}
// ProcessKubeCSR processes CSR request against Kubernetes CA, returns
// signed certificate if successful.
func (s *AuthServer) ProcessKubeCSR(req KubeCSR) (*KubeCSRResponse, error) {
if !modules.GetModules().SupportsKubernetes() {
return nil, trace.AccessDenied(
"this teleport cluster does not support kubernetes, please contact system administrator for support")
}
if err := req.CheckAndSetDefaults(); err != nil {
return nil, trace.Wrap(err)
}
clusterName, err := s.GetClusterName()
if err != nil {
return nil, trace.Wrap(err)
}
// Certificate for remote cluster is a user certificate
// with special provisions.
log.Debugf("Generating certificate to access remote Kubernetes clusters.")
hostCA, err := s.GetCertAuthority(services.CertAuthID{
Type: services.HostCA,
DomainName: req.ClusterName,
}, false)
if err != nil {
return nil, trace.Wrap(err)
}
csr, err := tlsca.ParseCertificateRequestPEM(req.CSR)
if err != nil {
return nil, trace.Wrap(err)
}
// Extract identity from the CSR. Pass zero time for id.Expiry, it won't be
// used here.
id, err := tlsca.FromSubject(csr.Subject, time.Time{})
if err != nil {
return nil, trace.Wrap(err)
}
// Enforce only k8s usage on generated cert, keep all other fields.
id.Usage = []string{teleport.UsageKubeOnly}
// Re-encode the identity to subject, with updated Usage.
subject, err := id.Subject()
if err != nil {
return nil, trace.Wrap(err)
}
// Extract user roles from the identity (from the CSR Subject).
roles, err := services.FetchRoles(id.Groups, s, id.Traits)
if err != nil {
return nil, trace.Wrap(err)
}
// Get the correct cert TTL based on roles.
ttl := roles.AdjustSessionTTL(defaults.CertDuration)
userCA, err := s.Trust.GetCertAuthority(services.CertAuthID{
Type: services.UserCA,
DomainName: clusterName.GetClusterName(),
}, true)
if err != nil {
return nil, trace.Wrap(err)
}
// generate TLS certificate
tlsAuthority, err := userCA.TLSCA()
if err != nil {
return nil, trace.Wrap(err)
}
certRequest := tlsca.CertificateRequest{
Clock: s.clock,
PublicKey: csr.PublicKey,
// Always trust the Subject sent by the proxy (minus the Usage field).
// A user may have received temporary extra roles via workflow API, we
// must preserve those. The storage backend doesn't record temporary
// granted roles.
Subject: subject,
NotAfter: s.clock.Now().UTC().Add(ttl),
}
tlsCert, err := tlsAuthority.GenerateCertificate(certRequest)
if err != nil {
return nil, trace.Wrap(err)
}
re := &KubeCSRResponse{Cert: tlsCert}
for _, keyPair := range hostCA.GetTLSKeyPairs() {
re.CertAuthorities = append(re.CertAuthorities, keyPair.Cert)
}
return re, nil
}