Git-Mirrors/constellation
1
0
Fork 0
mirror of https://github.com/edgelesssys/constellation.git synced 2025-04-20 07:25:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

adjusted key derivation logic to happen in the join client

Browse Source
This commit is contained in:
miampf 2025-01-09 12:34:01 +01:00
parent 9363206662
commit 23b23d8ed4
No known key found for this signature in database
GPG Key ID: EF039364B5B6886C
6 changed files with 26 additions and 42 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
bootstrapper/internal/joinclient/BUILD.bazel
View File

@ -21,6 +21,7 @@ go_library(
"@io_k8s_kubernetes//cmd/kubeadm/app/constants",
"@io_k8s_utils//clock",
"@org_golang_google_grpc//:grpc",
"@org_golang_x_crypto//ssh",
],
)

16
bootstrapper/internal/joinclient/joinclient.go
View File

@ -18,7 +18,9 @@ If the JoinClient finds an existing cluster, it will attempt to join it as eithe
package joinclient
import (
"bytes"
"context"
"crypto/ed25519"
"errors"
"fmt"
"log/slog"
@ -37,6 +39,7 @@ import (
"github.com/edgelesssys/constellation/v2/internal/versions/components"
"github.com/edgelesssys/constellation/v2/joinservice/joinproto"
"github.com/spf13/afero"
"golang.org/x/crypto/ssh"
"google.golang.org/grpc"
kubeadm "k8s.io/kubernetes/cmd/kubeadm/app/apis/kubeadm/v1beta3"
kubeconstants "k8s.io/kubernetes/cmd/kubeadm/app/constants"
@ -270,8 +273,19 @@ func (c *JoinClient) startNodeAndJoin(ticket *joinproto.IssueJoinTicketResponse,
if err := c.fileHandler.Write(certificate.KeyFilename, kubeletKey, file.OptMkdirAll); err != nil {
return fmt.Errorf("writing kubelet key: %w", err)
}
// derive CA key from emergency key
_, priv, err := ed25519.GenerateKey(bytes.NewReader(ticket.EmergencyCaKey))
if err != nil {
return fmt.Errorf("deriving ed25519 ssh emergency key: %w", err)
}
ca, err := ssh.NewSignerFromSigner(priv)
if err != nil {
return fmt.Errorf("creating emergency SSH CA key: %w", err)
}
// TODO(miampf): Make path a constant
if err := c.fileHandler.Write("/run/ssh/ssh_ca.pub", ticket.EmergencyCaKey, file.OptMkdirAll); err != nil {
if err := c.fileHandler.Write("/run/ssh/ssh_ca.pub", ssh.MarshalAuthorizedKey(ca.PublicKey()), file.OptMkdirAll); err != nil {
return fmt.Errorf("writing ca key: %w", err)
}

8
joinservice/internal/server/server.go
View File

@ -100,6 +100,13 @@ func (s *Server) IssueJoinTicket(ctx context.Context, req *joinproto.IssueJoinTi
return nil, status.Errorf(codes.Internal, "getting key for stateful disk: %s", err)
}
log.Info("Requesting emergency SSH CA derivation key")
sshCAKey, err := s.dataKeyGetter.GetDataKey(ctx, constants.SSHCAKeySuffix, 256)
if err != nil {
log.With(slog.Any("error", err)).Error("Failed to get emergency SSH CA derivation key")
return nil, status.Errorf(codes.Internal, "getting emergency SSH CA derivation key: %s", err)
}
log.Info("Creating Kubernetes join token")
kubeArgs, err := s.joinTokenGetter.GetJoinToken(constants.KubernetesJoinTokenTTL)
if err != nil {
@ -167,6 +174,7 @@ func (s *Server) IssueJoinTicket(ctx context.Context, req *joinproto.IssueJoinTi
KubeletCert: kubeletCert,
ControlPlaneFiles: controlPlaneFiles,
KubernetesComponents: components,
EmergencyCaKey: sshCAKey,
}, nil
}

1
keyservice/internal/server/BUILD.bazel
View File

@ -15,7 +15,6 @@ go_library(
"@org_golang_google_grpc//:grpc",
"@org_golang_google_grpc//codes",
"@org_golang_google_grpc//status",
"@org_golang_x_crypto//ssh",
],
)

27
keyservice/internal/server/server.go
View File

@ -8,9 +8,7 @@ SPDX-License-Identifier: AGPL-3.0-only
package server
import (
"bytes"
"context"
"crypto/ed25519"
"fmt"
"log/slog"
"net"
@ -20,7 +18,6 @@ import (
"github.com/edgelesssys/constellation/v2/internal/kms/kms"
"github.com/edgelesssys/constellation/v2/internal/logger"
"github.com/edgelesssys/constellation/v2/keyservice/keyserviceproto"
"golang.org/x/crypto/ssh"
"google.golang.org/grpc"
"google.golang.org/grpc/codes"
"google.golang.org/grpc/status"
@ -85,27 +82,3 @@ func (s *Server) GetDataKey(ctx context.Context, in *keyserviceproto.GetDataKeyR
}
return &keyserviceproto.GetDataKeyResponse{DataKey: key}, nil
}
// GetCAKey returns the CA key.
func (s *Server) GetCAKey(ctx context.Context, in *keyserviceproto.GetCAKeyRequest) (*keyserviceproto.GetCAKeyResponse, error) {
log := s.log.With("peerAddress", grpclog.PeerAddrFromContext(ctx))
key, err := s.conKMS.GetDEK(ctx, crypto.DEKPrefix, 256)
if err != nil {
log.With(slog.Any("error", err)).Error("Failed to get key for derivation")
return nil, status.Errorf(codes.Internal, "%v", err)
}
_, priv, err := ed25519.GenerateKey(bytes.NewReader(key))
if err != nil {
log.With(slog.Any("error", err)).Error("Failed to generate ed25519 key")
return nil, status.Errorf(codes.Internal, "%v", err)
}
ca, err := ssh.NewSignerFromKey(priv)
if err != nil {
log.With(slog.Any("error", err)).Error("Failed to generate CA key")
return nil, status.Errorf(codes.Internal, "%v", err)
}
return &keyserviceproto.GetCAKeyResponse{CaKey: ssh.MarshalAuthorizedKey(ca.PublicKey())}, nil
}

15
keyservice/keyserviceproto/keyservice.proto
View File

@ -4,22 +4,11 @@ package kms;
option go_package = "github.com/edgelesssys/constellation/v2/keyservice/keyserviceproto";
service API {
rpc GetDataKey(GetDataKeyRequest) returns (GetDataKeyResponse);
rpc GetCAKey(GetCAKeyRequest) returns (GetCAKeyResponse);
}
service API { rpc GetDataKey(GetDataKeyRequest) returns (GetDataKeyResponse); }
message GetDataKeyRequest {
string data_key_id = 1;
uint32 length = 2;
}
message GetDataKeyResponse {
bytes data_key = 1;
}
message GetCAKeyRequest {}
message GetCAKeyResponse {
bytes ca_key = 1;
}
message GetDataKeyResponse { bytes data_key = 1; }