[WIP] authenticated microservices #1238

petertrr · 2022-09-19T09:02:43Z

Make default HttpSecurityChain have lowest precedence, because it captures all endpoints (/**) and more specific matchers should be able to override it by using higher precedence. Make ConvertingAuthenticationManager primary bean to avoid conflict when autowiring by type
App-to-app authentication using ServiceAccount tokens (similarly to this authentication mode of Vault)
- Add a ServiceAccount microservice-sa for all microservices; mount its token as a projected volume
- Add a WebClientCustomizer to add this token as a custom header; token is updated every 5 minutes
- Add spring-security components to authorize request based on the service account token
- Add SA-based authentication for /internal endpoints of backend and for orchestartor and sandbox
Switch spring-cloud-kubernetes implementation from kubernetes-client to fabric8-client in save-backend
Enable loading ConfigMaps using spring-cloud-kubernetes integration (for some reason resolving ${spring.datasource.backend-url} won't work with existing loading of optional properties file)

Part of #1049

* Precompiled script plugin for kotlin-jvm plugin application and configuration * Move some dependencies to libs.versions.toml

…nt` to `fabric8-client` in save-backend

…ed-microservices # Conflicts: # buildSrc/src/main/kotlin/com/saveourtool/save/buildutils/kotlin-jvm-configuration.gradle.kts # gradle/libs.versions.toml # save-backend/build.gradle.kts # save-cloud-charts/save-cloud/templates/backend-deployment.yaml # save-orchestrator/build.gradle.kts

github-advanced-security

Found 15 potential problems in the proposed changes. Check the Files changed tab for more details.

save-backend/src/main/kotlin/com/saveourtool/save/backend/configs/WebSecurityConfig.kt

...-backend/src/main/kotlin/com/saveourtool/save/backend/utils/KubernetesAuthenticationUtils.kt

* Added WebFilter for applying token in headers

…ed-microservices

…ounted token

…ed-microservices

github-advanced-security

ktlint found more than 10 potential problems in the proposed changes. Check the Files changed tab for more details.

save-backend/src/main/kotlin/com/saveourtool/save/backend/configs/WebSecurityConfig.kt

...-backend/src/main/kotlin/com/saveourtool/save/backend/utils/KubernetesAuthenticationUtils.kt

…ed-microservices

…g it in in the preprocessor

…ed-microservices # Conflicts: # save-backend/src/main/kotlin/com/saveourtool/save/backend/utils/ConvertingAuthenticationManager.kt # save-backend/src/main/kotlin/com/saveourtool/save/backend/utils/CustomAuthenticationBasicConverter.kt

save-backend/src/main/kotlin/com/saveourtool/save/backend/configs/WebSecurityConfig.kt

…om preprocessor

…ed-microservices

…e in kapt config

…ed-microservices # Conflicts: # authentication-service/build.gradle.kts # save-cloud-charts/save-cloud/templates/backend-configmap.yaml # save-orchestrator/src/main/kotlin/com/saveourtool/save/orchestrator/service/BackendOrchestratorAgentService.kt # save-preprocessor/src/main/kotlin/com/saveourtool/save/preprocessor/SavePreprocessor.kt # save-sandbox/src/main/kotlin/com/saveourtool/save/sandbox/SaveSandbox.kt

…ed-microservices

…ces' into feature/authenticated-microservices

...vice/src/main/kotlin/com/saveourtool/save/authservice/config/SecurityWebClientCustomizers.kt

+ */
+@Configuration
+class SecurityWebClientCustomizers {
+    @Bean


…ed-microservices

# Conflicts: # .github/workflows/helm_push.yml # gradle/libs.versions.toml # save-backend/build.gradle.kts # save-backend/src/main/kotlin/com/saveourtool/save/backend/SaveApplication.kt # save-cloud-charts/save-cloud/templates/backend-deployment.yaml # save-sandbox/src/main/kotlin/com/saveourtool/save/sandbox/SaveSandbox.kt

sanyavertolet · 2023-04-05T09:44:17Z

save-cloud-charts/save-cloud/templates/backend-deployment.yaml

@@ -18,6 +18,7 @@ spec:
      annotations:
        {{- include "pod.common.annotations" (dict "service" .Values.backend ) | nindent 8 }}
    spec:
+      serviceAccountName: microservice-sa


As far as I can see, all the microservices that are able to send requests should have microservice-sa (e.g. demo-cpg does not send anything so service account for it is not required(?))

Moreover, it seems that orchestrator and demo role bindings should also reference microservice cluster role

The idea was, that communication between some microservices can still be secure without security, because we were planning to account only for not trusted executed tools and their network activity could be restricted with a NetworkPolicy on agent pods. This way using SA token for authentication is only required for microservices which receive requests from agents. But then, microservices that send requests to these services also need to authenticate, so it may be easier to unify everything.

As far as I can see, many things have been done: KubernetesAuthenticaitonUtils provide almost everything for X-Service-Account-Token check. So the question is: what hasn't been done yet? (regarding this PR) Seems that ktor needs to be able to add custom headers. And it seems that some Beans are required (e.g. KubernetesClient bean in KubernetesAuthenticationUtils). Am I right?

I suppose it was already more or less working. This PR affects only services, not agents, and I'm not sure if we have ktor on server-side. But yes, the part that validates token against k8s api server requires KubernetesClient. The part that adds it as a custom header requires the token to be mounted (added to YAML spec as projected volume)

sanyavertolet · 2023-04-05T09:47:33Z

save-preprocessor/src/main/kotlin/com/saveourtool/save/preprocessor/SavePreprocessor.kt

+@SpringBootApplication(exclude = [
+    ReactiveSecurityAutoConfiguration::class,
+    ReactiveUserDetailsServiceAutoConfiguration::class,
+    ReactiveManagementWebSecurityAutoConfiguration::class,
+])
 @EnableWebFlux
 @EnableConfigurationProperties(ConfigProperties::class)
+@Import(SecurityWebClientCustomizers::class)


It seems that all the microservices should also be configured with SecurityWebClientCustomizers. What if ktor client is used? Should we implement some kind of plugin that adds required header?

save-backend/src/main/kotlin/com/saveourtool/save/backend/SaveApplication.kt

petertrr · 2023-04-05T09:54:47Z

save-cloud-charts/save-cloud/templates/backend-deployment.yaml

@@ -18,6 +18,7 @@ spec:
      annotations:
        {{- include "pod.common.annotations" (dict "service" .Values.backend ) | nindent 8 }}
    spec:
+      serviceAccountName: microservice-sa


The idea was, that communication between some microservices can still be secure without security, because we were planning to account only for not trusted executed tools and their network activity could be restricted with a NetworkPolicy on agent pods. This way using SA token for authentication is only required for microservices which receive requests from agents. But then, microservices that send requests to these services also need to authenticate, so it may be easier to unify everything.

petertrr added 3 commits September 15, 2022 15:47

Improvements for Gradle build

8009db2

* Precompiled script plugin for kotlin-jvm plugin application and configuration * Move some dependencies to libs.versions.toml

Switch spring-cloud-kubernetes implementation from `kubernetes-clie…

d75fe3c

…nt` to `fabric8-client` in save-backend

[skip ci] [WIP] App-to-app authentication using ServiceAccount tokens

8796ed7

nulls mentioned this pull request Sep 28, 2022

Routing for /sandbox/api #1264

Merged

github-advanced-security bot found potential problems Sep 29, 2022

View reviewed changes

petertrr added 5 commits September 29, 2022 15:54

[skip ci] WIP: authenticated microservices

90c27ca

* Added WebFilter for applying token in headers

Merge remote-tracking branch 'origin/master' into feature/authenticat…

b501eda

…ed-microservices

[skip ci] Extract sa-token mount into _helpers.tpl; fix path to the m…

12f01d9

…ounted token

Read ConfigMap using Kubernetes fabric8 client

bb7f1de

Merge remote-tracking branch 'origin/master' into feature/authenticat…

8e27f7d

…ed-microservices

github-advanced-security bot found potential problems Oct 7, 2022

View reviewed changes

petertrr added 4 commits October 11, 2022 14:07

Merge remote-tracking branch 'origin/master' into feature/authenticat…

6121181

…ed-microservices

[skip ci] Extract the WebClientCustomizer into save-cloud-common, plu…

2b0900d

…g it in in the preprocessor

[skip ci] Cleanup

415c4f6

github-advanced-security bot found potential problems Oct 14, 2022

View reviewed changes

save-backend/src/main/kotlin/com/saveourtool/save/backend/configs/WebSecurityConfig.kt Fixed Show fixed Hide fixed

save-backend/src/main/kotlin/com/saveourtool/save/backend/configs/WebSecurityConfig.kt Fixed Show fixed Hide fixed

petertrr added 7 commits October 14, 2022 15:34

[Helm] Set another port as a management port for all JVM services

09df217

[skip ci] WIP

c235283

Enable @ConditionalOnCloudPlatform for web client customizer bean

5c12d11

Handle error status code when uploading test suite source snapshot fr…

49a25a3

…om preprocessor

Disable CSRF so that everything works

1de5b2f

Merge remote-tracking branch 'origin/master' into feature/authenticat…

86dd0a9

…ed-microservices

[skip ci] Move KubernetesAuthenticationUtils to save-cloud-common

e390516

petertrr force-pushed the feature/authenticated-microservices branch from 2097ab0 to e390516 Compare October 20, 2022 07:04

This was referenced Oct 20, 2022

[Helm] Set another port as a management port for all JVM services #1342

Merged

Restrict network access of the executed tool #1049

Open

Merge remote-tracking branch 'origin/master' into feature/authenticat…

a612f55

…ed-microservices

petertrr added 11 commits November 24, 2022 10:15

One more experiment to fix Kapt error

aa06a2c

One more experiment to fix Kapt error

4ae4edd

Remove most of JPA related depdencies from auth service; revert chang…

ac57556

…e in kapt config

Follow-ups after merge

804dffa

Update helm_push.yml

dce76ae

Update helm_push.yml

467483c

Merge remote-tracking branch 'origin/master' into feature/authenticat…

f1265ff

…ed-microservices

Fixme until #1247

64bd7df

Eclude security autoconfuguration from preprocessor

bbd1b34

Merge remote-tracking branch 'origin/feature/authenticated-microservi…

64ac8f2

…ces' into feature/authenticated-microservices

github-advanced-security bot found potential problems Dec 12, 2022

View reviewed changes

petertrr added 5 commits December 13, 2022 16:18

Merge remote-tracking branch 'origin/master' into feature/authenticat…

2e24b08

…ed-microservices

Merge remote-tracking branch 'origin/master' into feature/authenticat…

bc4fb35

…ed-microservices

Merge remote-tracking branch 'origin/master' into feature/authenticat…

5813501

…ed-microservices

Add more endpoints to exclusion list

df910bb

Merge remote-tracking branch 'origin/master' into feature/authenticat…

11a89f5

…ed-microservices

icemachined force-pushed the master branch from d92be76 to 65c52ab Compare January 10, 2023 04:26

sanyavertolet self-assigned this Apr 5, 2023

sanyavertolet added enhancement New feature or request infra Issues related to build or deploy infrastructure labels Apr 5, 2023

[skip ci] updated branch

ee6e5a1

sanyavertolet reviewed Apr 5, 2023

View reviewed changes

petertrr commented Apr 5, 2023

View reviewed changes

sanyavertolet added 3 commits April 5, 2023 14:45

[skip ci] added SA to demo and gateway

5c3c681

[skip ci] wrapper tokenewviews

925d062

Merge branch 'master' into feature/authenticated-microservices

fb80354

kgevorkyan mentioned this pull request Jun 29, 2023

[EPIC] Authorization service for SAVE cloud #1299

Closed

Merge branch 'master' into feature/authenticated-microservices

76ce335

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] authenticated microservices #1238

[WIP] authenticated microservices #1238

petertrr commented Sep 19, 2022 •

edited

Loading

github-advanced-security bot left a comment

github-advanced-security bot left a comment

sanyavertolet Apr 5, 2023

petertrr Apr 5, 2023

sanyavertolet Apr 5, 2023

petertrr Apr 5, 2023

sanyavertolet Apr 5, 2023

petertrr Apr 5, 2023

[WIP] authenticated microservices #1238

Are you sure you want to change the base?

[WIP] authenticated microservices #1238

Conversation

petertrr commented Sep 19, 2022 • edited Loading

github-advanced-security bot left a comment

Choose a reason for hiding this comment

github-advanced-security bot left a comment

Choose a reason for hiding this comment

sanyavertolet Apr 5, 2023

Choose a reason for hiding this comment

petertrr Apr 5, 2023

Choose a reason for hiding this comment

sanyavertolet Apr 5, 2023

Choose a reason for hiding this comment

petertrr Apr 5, 2023

Choose a reason for hiding this comment

sanyavertolet Apr 5, 2023

Choose a reason for hiding this comment

petertrr Apr 5, 2023

Choose a reason for hiding this comment

petertrr commented Sep 19, 2022 •

edited

Loading