From 9771f054ea6fdb0f4c00352c310fae8cdc60332b Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Fri, 28 Sep 2018 19:04:57 -0500 Subject: [PATCH] Add slide about lack of cert revocation --- slides/k8s/authn-authz.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/slides/k8s/authn-authz.md b/slides/k8s/authn-authz.md index 65d4bafd..0328e9e5 100644 --- a/slides/k8s/authn-authz.md +++ b/slides/k8s/authn-authz.md @@ -135,6 +135,26 @@ class: extra-details --- +## User certificates in practice + +- The Kubernetes API server does not support certificate revocation + + (see issue [#18982](https://github.com/kubernetes/kubernetes/issues/18982)) + +- There are workarounds, but they are very inconvenient: + + - issue short-lived certificates (e.g. 24 hours) and regenerate them often + + - re-create the CA and re-issue all certificates in case of compromise + + - grant permissions to individual users, not groups +
+ (and remove all permissions to a compromised user) + +- Until this is fixed, we probably want to use other methods + +--- + ## Authentication with tokens - Tokens are passed as HTTP headers: