{"action":"created","comment":{"url":"https://api.github.com/repos/jetstack/tarmak/pulls/comments/176105677","pull_request_review_id":105749739,"id":176105677,"diff_hunk":"@@ -0,0 +1,154 @@\n+.. vim:set ft=rst spell:\n+\n+Custom Vault Auth Provider for EC2 Instances - A Proposal\n+===========\n+\n+This proposal suggests writing a custom authentication provider for Vault.\n+This provider would allow access privileges, especially to the PKI secrets\n+provider, to be locked down per EC2 Instance, which is not currently possible.\n+\n+Background\n+==========\n+\n+Glossary\n+--------\n+\n+-  IAM Role (iam-role) - an IAM principal. Our instances have an IAM\n+   role attached which they use as a service account.\n+   https://docs.aws.amazon.com/IAM/latest/UserGuide/id\\_roles.html\n+-  IAM Policy (iam-policy) - the authz rules (and rules documents) in\n+   AWS.\n+-  Vault Token (vault-token) - common identity document given by all\n+   vault auth providers. Has a list of policy (documents).\n+-  Vault Policy (vault-policy) - both the policy language itself (giving\n+   authorization for vault operations), document of those policy\n+   statement,s and the list of such documents named on a vault-token.\n+   vault-policy has its own type, which we'll call *policy*\n+-  Vault PKI Role (pki-role) - vault-policy isn't very powerful wrt to\n+   PKI operations, e.g. it doesn't let you lock PKI certificate issuance\n+   down to specific CNs etc. The PKI secrets provider has its own\n+   mechanism for this; the PKI role. pki-roles live at paths and access\n+   is controlled by vault-policy. pki-roles are implemented as vault\n+   generic secrets.\n+   https://www.vaultproject.io/api/secret/pki/index.html#create-update-role\n+\n+Problem\n+-------\n+\n+We would like to have individual Vault policies per EC2 instance, so\n+that they can't issue themselves certificates for anyone else's FQDN.\n+\n+See:\n+\n+- https://github.com/jetstack/tarmak/issues/120\n+- https://github.com/jetstack/tarmak/issues/34\n+\n+Posibilities\n+------------\n+\n+Due to several Vault limitations, especially in the free version, it's\n+not possible to:\n+\n+- Add a vault-policy (name) to a token after it's been created (by vault ec2 login)\n+- Specify a vault-policy expressive enough to re-use one policy for all EC2 Instances (i.e. no variable back-references)\n+- Vault Premium has a different policy language called Sentinel, which looks like it could do this\n+- Use the k8s auth provider, as we also want to use this mechanism with etcd Instances, etc, which do not run Kubelet\n+\n+Objective\n+=========\n+\n+Solution\n+--------\n+\n+Our proposed solution is Vault auth provider. This will auth EC2 instances using their IID like the current AWS auth provider does, but it will also generate new vault-policies and pki-roles on the fly, which will e.g. limit their cert creation power to just that instance's DNS name.\n+\n+This vault auth plugin will serve exactly one environment (i.e. all kubernetes clusters in the same (provider, region))\n+\n+On login, our provider will:\n+\n+- Auth the Instance like the AWS provider's EC2 mode does (can we simply defer to that code?)\n+- Match the iam-role attached to the Instance against our Provider's config, using its ARN\n+- Make a pki-role from the configured template for that iam-role\n+- Make a vault-policy (document) from the configured template for that iam-role, including templating in the name of the pki-role\n+\n+  - This should have a unique name based on the AWS Instance ID / boot ID / etc","path":"docs/proposals/vault-auth-provider.rst","position":74,"original_position":74,"commit_id":"25936f1f827d984174138f5abd78bfd9f0782693","original_commit_id":"25936f1f827d984174138f5abd78bfd9f0782693","user":{"login":"simonswine","id":223048,"avatar_url":"https://avatars0.githubusercontent.com/u/223048?v=4","gravatar_id":"","url":"https://api.github.com/users/simonswine","html_url":"https://github.com/simonswine","followers_url":"https://api.github.com/users/simonswine/followers","following_url":"https://api.github.com/users/simonswine/following{/other_user}","gists_url":"https://api.github.com/users/simonswine/gists{/gist_id}","starred_url":"https://api.github.com/users/simonswine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simonswine/subscriptions","organizations_url":"https://api.github.com/users/simonswine/orgs","repos_url":"https://api.github.com/users/simonswine/repos","events_url":"https://api.github.com/users/simonswine/events{/privacy}","received_events_url":"https://api.github.com/users/simonswine/received_events","type":"User","site_admin":false},"body":"Yeah right now wing is not involved, if we scale up a prebacked worker image, before the node becomes healthy and usuable.\r\n\r\nMaking wing a vault controller, would require a (more secure and HA) setup of wing. Then we would need a tarmak for setting up wing :see_no_evil: \r\n\r\nGiving wing that unneeded ","created_at":"2018-03-21T14:39:35Z","updated_at":"2018-03-21T14:39:36Z","html_url":"https://github.com/jetstack/tarmak/pull/140#discussion_r176105677","pull_request_url":"https://api.github.com/repos/jetstack/tarmak/pulls/140","author_association":"OWNER","_links":{"self":{"href":"https://api.github.com/repos/jetstack/tarmak/pulls/comments/176105677"},"html":{"href":"https://github.com/jetstack/tarmak/pull/140#discussion_r176105677"},"pull_request":{"href":"https://api.github.com/repos/jetstack/tarmak/pulls/140"}},"in_reply_to_id":176076178},"pull_request":{"url":"https://api.github.com/repos/jetstack/tarmak/pulls/140","id":176469653,"html_url":"https://github.com/jetstack/tarmak/pull/140","diff_url":"https://github.com/jetstack/tarmak/pull/140.diff","patch_url":"https://github.com/jetstack/tarmak/pull/140.patch","issue_url":"https://api.github.com/repos/jetstack/tarmak/issues/140","number":140,"state":"open","locked":false,"title":"Add proposal for a custom vault auth provider","user":{"login":"mt-inside","id":1371795,"avatar_url":"https://avatars1.githubusercontent.com/u/1371795?v=4","gravatar_id":"","url":"https://api.github.com/users/mt-inside","html_url":"https://github.com/mt-inside","followers_url":"https://api.github.com/users/mt-inside/followers","following_url":"https://api.github.com/users/mt-inside/following{/other_user}","gists_url":"https://api.github.com/users/mt-inside/gists{/gist_id}","starred_url":"https://api.github.com/users/mt-inside/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mt-inside/subscriptions","organizations_url":"https://api.github.com/users/mt-inside/orgs","repos_url":"https://api.github.com/users/mt-inside/repos","events_url":"https://api.github.com/users/mt-inside/events{/privacy}","received_events_url":"https://api.github.com/users/mt-inside/received_events","type":"User","site_admin":false},"body":"","created_at":"2018-03-21T13:06:51Z","updated_at":"2018-03-21T14:39:36Z","closed_at":null,"merged_at":null,"merge_commit_sha":"a3c780b9f626dbc47ae267fda964053658457f49","assignee":null,"assignees":[],"requested_reviewers":[{"login":"kragniz","id":735008,"avatar_url":"https://avatars2.githubusercontent.com/u/735008?v=4","gravatar_id":"","url":"https://api.github.com/users/kragniz","html_url":"https://github.com/kragniz","followers_url":"https://api.github.com/users/kragniz/followers","following_url":"https://api.github.com/users/kragniz/following{/other_user}","gists_url":"https://api.github.com/users/kragniz/gists{/gist_id}","starred_url":"https://api.github.com/users/kragniz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kragniz/subscriptions","organizations_url":"https://api.github.com/users/kragniz/orgs","repos_url":"https://api.github.com/users/kragniz/repos","events_url":"https://api.github.com/users/kragniz/events{/privacy}","received_events_url":"https://api.github.com/users/kragniz/received_events","type":"User","site_admin":false}],"requested_teams":[],"labels":[{"id":729324071,"url":"https://api.github.com/repos/jetstack/tarmak/labels/do-not-merge/release-note-label-needed","name":"do-not-merge/release-note-label-needed","color":"e11d21","default":false},{"id":729324232,"url":"https://api.github.com/repos/jetstack/tarmak/labels/size/L","name":"size/L","color":"ee9900","default":false}],"milestone":null,"commits_url":"https://api.github.com/repos/jetstack/tarmak/pulls/140/commits","review_comments_url":"https://api.github.com/repos/jetstack/tarmak/pulls/140/comments","review_comment_url":"https://api.github.com/repos/jetstack/tarmak/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jetstack/tarmak/issues/140/comments","statuses_url":"https://api.github.com/repos/jetstack/tarmak/statuses/25936f1f827d984174138f5abd78bfd9f0782693","head":{"label":"mt-inside:master","ref":"master","sha":"25936f1f827d984174138f5abd78bfd9f0782693","user":{"login":"mt-inside","id":1371795,"avatar_url":"https://avatars1.githubusercontent.com/u/1371795?v=4","gravatar_id":"","url":"https://api.github.com/users/mt-inside","html_url":"https://github.com/mt-inside","followers_url":"https://api.github.com/users/mt-inside/followers","following_url":"https://api.github.com/users/mt-inside/following{/other_user}","gists_url":"https://api.github.com/users/mt-inside/gists{/gist_id}","starred_url":"https://api.github.com/users/mt-inside/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mt-inside/subscriptions","organizations_url":"https://api.github.com/users/mt-inside/orgs","repos_url":"https://api.github.com/users/mt-inside/repos","events_url":"https://api.github.com/users/mt-inside/events{/privacy}","received_events_url":"https://api.github.com/users/mt-inside/received_events","type":"User","site_admin":false},"repo":{"id":126179268,"name":"tarmak","full_name":"mt-inside/tarmak","owner":{"login":"mt-inside","id":1371795,"avatar_url":"https://avatars1.githubusercontent.com/u/1371795?v=4","gravatar_id":"","url":"https://api.github.com/users/mt-inside","html_url":"https://github.com/mt-inside","followers_url":"https://api.github.com/users/mt-inside/followers","following_url":"https://api.github.com/users/mt-inside/following{/other_user}","gists_url":"https://api.github.com/users/mt-inside/gists{/gist_id}","starred_url":"https://api.github.com/users/mt-inside/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mt-inside/subscriptions","organizations_url":"https://api.github.com/users/mt-inside/orgs","repos_url":"https://api.github.com/users/mt-inside/repos","events_url":"https://api.github.com/users/mt-inside/events{/privacy}","received_events_url":"https://api.github.com/users/mt-inside/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mt-inside/tarmak","description":"A toolkit for Kubernetes cluster provisioning and lifecycle management","fork":true,"url":"https://api.github.com/repos/mt-inside/tarmak","forks_url":"https://api.github.com/repos/mt-inside/tarmak/forks","keys_url":"https://api.github.com/repos/mt-inside/tarmak/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mt-inside/tarmak/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mt-inside/tarmak/teams","hooks_url":"https://api.github.com/repos/mt-inside/tarmak/hooks","issue_events_url":"https://api.github.com/repos/mt-inside/tarmak/issues/events{/number}","events_url":"https://api.github.com/repos/mt-inside/tarmak/events","assignees_url":"https://api.github.com/repos/mt-inside/tarmak/assignees{/user}","branches_url":"https://api.github.com/repos/mt-inside/tarmak/branches{/branch}","tags_url":"https://api.github.com/repos/mt-inside/tarmak/tags","blobs_url":"https://api.github.com/repos/mt-inside/tarmak/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mt-inside/tarmak/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mt-inside/tarmak/git/refs{/sha}","trees_url":"https://api.github.com/repos/mt-inside/tarmak/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mt-inside/tarmak/statuses/{sha}","languages_url":"https://api.github.com/repos/mt-inside/tarmak/languages","stargazers_url":"https://api.github.com/repos/mt-inside/tarmak/stargazers","contributors_url":"https://api.github.com/repos/mt-inside/tarmak/contributors","subscribers_url":"https://api.github.com/repos/mt-inside/tarmak/subscribers","subscription_url":"https://api.github.com/repos/mt-inside/tarmak/subscription","commits_url":"https://api.github.com/repos/mt-inside/tarmak/commits{/sha}","git_commits_url":"https://api.github.com/repos/mt-inside/tarmak/git/commits{/sha}","comments_url":"https://api.github.com/repos/mt-inside/tarmak/comments{/number}","issue_comment_url":"https://api.github.com/repos/mt-inside/tarmak/issues/comments{/number}","contents_url":"https://api.github.com/repos/mt-inside/tarmak/contents/{+path}","compare_url":"https://api.github.com/repos/mt-inside/tarmak/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mt-inside/tarmak/merges","archive_url":"https://api.github.com/repos/mt-inside/tarmak/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mt-inside/tarmak/downloads","issues_url":"https://api.github.com/repos/mt-inside/tarmak/issues{/number}","pulls_url":"https://api.github.com/repos/mt-inside/tarmak/pulls{/number}","milestones_url":"https://api.github.com/repos/mt-inside/tarmak/milestones{/number}","notifications_url":"https://api.github.com/repos/mt-inside/tarmak/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mt-inside/tarmak/labels{/name}","releases_url":"https://api.github.com/repos/mt-inside/tarmak/releases{/id}","deployments_url":"https://api.github.com/repos/mt-inside/tarmak/deployments","created_at":"2018-03-21T13:01:22Z","updated_at":"2018-03-21T13:05:56Z","pushed_at":"2018-03-21T13:05:55Z","git_url":"git://github.com/mt-inside/tarmak.git","ssh_url":"git@github.com:mt-inside/tarmak.git","clone_url":"https://github.com/mt-inside/tarmak.git","svn_url":"https://github.com/mt-inside/tarmak","homepage":"","size":79970,"stargazers_count":0,"watchers_count":0,"language":"Ruby","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"jetstack:master","ref":"master","sha":"d71f3b9a42bccf9cb2b67d8d4eb86d54df39a258","user":{"login":"jetstack","id":13183983,"avatar_url":"https://avatars1.githubusercontent.com/u/13183983?v=4","gravatar_id":"","url":"https://api.github.com/users/jetstack","html_url":"https://github.com/jetstack","followers_url":"https://api.github.com/users/jetstack/followers","following_url":"https://api.github.com/users/jetstack/following{/other_user}","gists_url":"https://api.github.com/users/jetstack/gists{/gist_id}","starred_url":"https://api.github.com/users/jetstack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jetstack/subscriptions","organizations_url":"https://api.github.com/users/jetstack/orgs","repos_url":"https://api.github.com/users/jetstack/repos","events_url":"https://api.github.com/users/jetstack/events{/privacy}","received_events_url":"https://api.github.com/users/jetstack/received_events","type":"Organization","site_admin":false},"repo":{"id":96748966,"name":"tarmak","full_name":"jetstack/tarmak","owner":{"login":"jetstack","id":13183983,"avatar_url":"https://avatars1.githubusercontent.com/u/13183983?v=4","gravatar_id":"","url":"https://api.github.com/users/jetstack","html_url":"https://github.com/jetstack","followers_url":"https://api.github.com/users/jetstack/followers","following_url":"https://api.github.com/users/jetstack/following{/other_user}","gists_url":"https://api.github.com/users/jetstack/gists{/gist_id}","starred_url":"https://api.github.com/users/jetstack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jetstack/subscriptions","organizations_url":"https://api.github.com/users/jetstack/orgs","repos_url":"https://api.github.com/users/jetstack/repos","events_url":"https://api.github.com/users/jetstack/events{/privacy}","received_events_url":"https://api.github.com/users/jetstack/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/jetstack/tarmak","description":"A toolkit for Kubernetes cluster provisioning and lifecycle management","fork":false,"url":"https://api.github.com/repos/jetstack/tarmak","forks_url":"https://api.github.com/repos/jetstack/tarmak/forks","keys_url":"https://api.github.com/repos/jetstack/tarmak/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jetstack/tarmak/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jetstack/tarmak/teams","hooks_url":"https://api.github.com/repos/jetstack/tarmak/hooks","issue_events_url":"https://api.github.com/repos/jetstack/tarmak/issues/events{/number}","events_url":"https://api.github.com/repos/jetstack/tarmak/events","assignees_url":"https://api.github.com/repos/jetstack/tarmak/assignees{/user}","branches_url":"https://api.github.com/repos/jetstack/tarmak/branches{/branch}","tags_url":"https://api.github.com/repos/jetstack/tarmak/tags","blobs_url":"https://api.github.com/repos/jetstack/tarmak/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jetstack/tarmak/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jetstack/tarmak/git/refs{/sha}","trees_url":"https://api.github.com/repos/jetstack/tarmak/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jetstack/tarmak/statuses/{sha}","languages_url":"https://api.github.com/repos/jetstack/tarmak/languages","stargazers_url":"https://api.github.com/repos/jetstack/tarmak/stargazers","contributors_url":"https://api.github.com/repos/jetstack/tarmak/contributors","subscribers_url":"https://api.github.com/repos/jetstack/tarmak/subscribers","subscription_url":"https://api.github.com/repos/jetstack/tarmak/subscription","commits_url":"https://api.github.com/repos/jetstack/tarmak/commits{/sha}","git_commits_url":"https://api.github.com/repos/jetstack/tarmak/git/commits{/sha}","comments_url":"https://api.github.com/repos/jetstack/tarmak/comments{/number}","issue_comment_url":"https://api.github.com/repos/jetstack/tarmak/issues/comments{/number}","contents_url":"https://api.github.com/repos/jetstack/tarmak/contents/{+path}","compare_url":"https://api.github.com/repos/jetstack/tarmak/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jetstack/tarmak/merges","archive_url":"https://api.github.com/repos/jetstack/tarmak/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jetstack/tarmak/downloads","issues_url":"https://api.github.com/repos/jetstack/tarmak/issues{/number}","pulls_url":"https://api.github.com/repos/jetstack/tarmak/pulls{/number}","milestones_url":"https://api.github.com/repos/jetstack/tarmak/milestones{/number}","notifications_url":"https://api.github.com/repos/jetstack/tarmak/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jetstack/tarmak/labels{/name}","releases_url":"https://api.github.com/repos/jetstack/tarmak/releases{/id}","deployments_url":"https://api.github.com/repos/jetstack/tarmak/deployments","created_at":"2017-07-10T07:32:26Z","updated_at":"2018-03-21T08:34:25Z","pushed_at":"2018-03-21T13:06:51Z","git_url":"git://github.com/jetstack/tarmak.git","ssh_url":"git@github.com:jetstack/tarmak.git","clone_url":"https://github.com/jetstack/tarmak.git","svn_url":"https://github.com/jetstack/tarmak","homepage":"","size":79967,"stargazers_count":148,"watchers_count":148,"language":"Ruby","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":17,"mirror_url":null,"archived":false,"open_issues_count":48,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":17,"open_issues":48,"watchers":148,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jetstack/tarmak/pulls/140"},"html":{"href":"https://github.com/jetstack/tarmak/pull/140"},"issue":{"href":"https://api.github.com/repos/jetstack/tarmak/issues/140"},"comments":{"href":"https://api.github.com/repos/jetstack/tarmak/issues/140/comments"},"review_comments":{"href":"https://api.github.com/repos/jetstack/tarmak/pulls/140/comments"},"review_comment":{"href":"https://api.github.com/repos/jetstack/tarmak/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jetstack/tarmak/pulls/140/commits"},"statuses":{"href":"https://api.github.com/repos/jetstack/tarmak/statuses/25936f1f827d984174138f5abd78bfd9f0782693"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"simonswine"}}