Support IPsec Certificate-based Authentication #3778

xliuxu · 2022-05-13T02:46:37Z

Introduce a new authentication mode for IPsec tunnel encryption.
A new config ipsec.authenticationMode is added to the Agent.
Now Antrea supports both "psk" and "cert" modes for IPsec
authentication If "cert" is enabled, Antrea Agent will request IPsec
certificates by Kubernetes CertificateSigningRequests API with
signer name antrea.io/antrea-agent-ipsec-tunnel. Antrea Controller
will validate the requests and issue certificates if the request is
permitted.

The signer antrea.io/antrea-agent-ipsec-tunnel in Antrea Controller
has the following properties:

Trust distribution - CA certificate will be saved as a ConfigMap
antrea-ipsec-ca in kube-system namespace.
Permitted subjects - organizations are exactly ["antrea.io"], common
name must be one of the Node names.
Permitted x509 extension - honors key usage and DNSName
extensions, forbids other subjectAltName extensions. DNS name
must be the same as the common name.
Permitted key usages - exactly ["ipsec tunnel"]
Expiration/certificate lifetime - defaults to 1 year.
CA bit allowed/disallowed - not allowed.

The CSRs can be automatically approved by default. Antrea Controller
will validate Pod identity to provide maximum security if the Kubernetes
BoundServiceAccountTokenVolume feature gate is enabled. Antrea
Agents will renew certificates automatically when the certificate
reaches approximately 80% of the lifetime.

This feature requires feature gate IPsecCertAuth to be enabled.

Closes: #3765

Signed-off-by: Xu Liu xliu2@vmware.com

codecov-commenter · 2022-05-17T14:57:17Z

Codecov Report

Merging #3778 (a9d57fb) into main (05504f0) will decrease coverage by 1.38%.
The diff coverage is 61.81%.

@@            Coverage Diff             @@
##             main    #3778      +/-   ##
==========================================
- Coverage   62.12%   60.73%   -1.39%     
==========================================
  Files         281      290       +9     
  Lines       40096    41219    +1123     
==========================================
+ Hits        24909    25035     +126     
- Misses      13215    14154     +939     
- Partials     1972     2030      +58

Flag	Coverage Δ
kind-e2e-tests	`45.51% <5.70%> (-2.37%)`	⬇️
unit-tests	`44.30% <57.79%> (+0.38%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/agent/config/node_config.go	`100.00% <ø> (ø)`
pkg/agent/interfacestore/types.go	`66.66% <0.00%> (ø)`
pkg/features/antrea_features.go	`11.11% <ø> (ø)`
pkg/agent/agent.go	`53.80% <26.31%> (-0.87%)`	⬇️
pkg/ovs/ovsconfig/ovs_client.go	`46.66% <41.66%> (-0.72%)`	⬇️
pkg/agent/config/ipsec_authentication_mode.go	`53.84% <53.84%> (ø)`
...catesigningrequest/ipsec_csr_signing_controller.go	`61.65% <61.65%> (ø)`
...r/ipseccertificate/ipsec_certificate_controller.go	`62.54% <62.54%> (ø)`
pkg/controller/certificatesigningrequest/common.go	`64.58% <64.58%> (ø)`
...er/certificatesigningrequest/ipsec_csr_approver.go	`66.27% <66.27%> (ø)`
... and 82 more

pkg/agent/controller/ipseccertificate/ipsec_certificate_controller.go

pkg/controller/certificatesigningrequest/approver_controller.go

jianjuns

I feel we need a feature gate for this.

build/charts/antrea/conf/antrea-controller.conf

cmd/antrea-agent/agent.go

build/charts/antrea/conf/antrea-controller.conf

pkg/agent/controller/ipseccertificate/ipsec_certificate_controller.go

pkg/agent/controller/noderoute/node_route_controller.go

pkg/config/controller/auto_approve_policy.go

pkg/controller/certificatesigningrequest/approver_controller.go

pkg/controller/certificatesigningrequest/signer_controller.go

xliuxu · 2022-05-18T16:26:30Z

During the manual tests, i found that keeping certificate names while rotating certificates will not work. Not only because the monitor script of OVS will not detect such changes, strongswan will also not load the certificate as long as the cert defined in ipsec.conf is not changed. And there is no command to trigger re-reading the certificate other than ipsec reload, which is too heavy. So I changed the renewal approach to creating different files for new certificates.

build/charts/antrea/values.yaml

build/charts/antrea/conf/antrea-controller.conf

cmd/antrea-agent/agent.go

xliuxu · 2022-05-27T04:46:11Z

/test-e2e

xliuxu · 2022-05-27T05:59:14Z

/test-e2e

cmd/antrea-agent/agent.go

pkg/agent/controller/ipseccertificate/ipsec_certificate_controller.go

pkg/agent/controller/noderoute/node_route_controller.go

tnqn

LGTM, thanks

tnqn · 2022-05-30T05:30:47Z

/test-all
/test-ipv6-e2e
/test-ipv6-only-e2e

Introduce a new authentication mode for IPsec tunnel encryption. A new config `ipsec.authenticationMode` is added to the Agent. Now Antrea supports both "psk" and "cert" modes for IPsec authentication If "cert" is enabled, Antrea Agent will request IPsec certificates by Kubernetes CertificateSigningRequests API with signer name `antrea.io/antrea-agent-ipsec-tunnel`. Antrea Controller will validate the requests and issue certificates if the request is permitted. The signer `antrea.io/antrea-agent-ipsec-tunnel` in Antrea Controller has the following properties: - Trust distribution - CA certificate will be saved as a ConfigMap `antrea-ipsec-ca` in `kube-system` namespace. - Permitted subjects - organizations are exactly ["antrea.io"], common name must be one of the Node names. - Permitted x509 extension - honors key usage and DNSName extensions, forbids other subjectAltName extensions. DNS name must be the same as the common name. - Permitted key usages - exactly ["ipsec tunnel"] - Expiration/certificate lifetime - defaults to 1 year. - CA bit allowed/disallowed - not allowed. The CSRs can be automatically approved by default. Antrea Controller will validate Pod identity to provide maximum security if the Kubernetes `BoundServiceAccountTokenVolume` feature gate is enabled. Antrea Agents will renew certificates automatically when the certificate reaches approximately 80% of the lifetime. This feature requires feature gate `IPsecCertAuth` to be enabled. Closes: antrea-io#3765 Signed-off-by: Xu Liu <xliu2@vmware.com>

xliuxu · 2022-05-30T08:49:17Z

/test-all
/test-ipv6-e2e
/test-ipv6-only-e2e

xliuxu · 2022-05-30T10:56:03Z

/test-networkpolicy

tnqn · 2022-05-30T14:54:37Z

/test-networkpolicy

xliuxu · 2022-05-30T15:31:06Z

/test-networkpolicy

xliuxu · 2022-05-31T00:24:28Z

/test-networkpolicy

xliuxu · 2022-05-31T00:49:54Z

/test-networkpolicy

xliuxu · 2022-05-31T01:12:59Z

/test-networkpolicy

xliuxu force-pushed the ipsec-cert branch 4 times, most recently from d1105d2 to 3e4b14c Compare May 13, 2022 03:06

xliuxu added this to the Antrea v1.7 release milestone May 13, 2022

xliuxu force-pushed the ipsec-cert branch 5 times, most recently from b3cfb9d to b909b81 Compare May 17, 2022 14:08

xliuxu marked this pull request as ready for review May 17, 2022 14:09

xliuxu changed the title ~~[WIP] Support IPsec Certificate-based Authentication~~ Support IPsec Certificate-based Authentication May 17, 2022

xliuxu force-pushed the ipsec-cert branch from b909b81 to 7110731 Compare May 17, 2022 14:13

xliuxu force-pushed the ipsec-cert branch from 7110731 to 4745ceb Compare May 17, 2022 15:22

xliuxu requested review from tnqn and jianjuns May 17, 2022 15:23

wenyingd reviewed May 17, 2022

View reviewed changes

jianjuns reviewed May 18, 2022

View reviewed changes

build/charts/antrea/conf/antrea-controller.conf Outdated Show resolved Hide resolved

build/charts/antrea/conf/antrea-controller.conf Outdated Show resolved Hide resolved

cmd/antrea-agent/agent.go Outdated Show resolved Hide resolved

tnqn reviewed May 18, 2022

View reviewed changes

build/charts/antrea/conf/antrea-controller.conf Outdated Show resolved Hide resolved

build/charts/antrea/conf/antrea-controller.conf Outdated Show resolved Hide resolved

pkg/agent/controller/ipseccertificate/ipsec_certificate_controller.go Outdated Show resolved Hide resolved

tnqn reviewed May 18, 2022

View reviewed changes

pkg/agent/controller/ipseccertificate/ipsec_certificate_controller.go Show resolved Hide resolved

tnqn reviewed May 18, 2022

View reviewed changes

xliuxu force-pushed the ipsec-cert branch from 4745ceb to f4e733e Compare May 18, 2022 16:10

antoninbas reviewed May 18, 2022

View reviewed changes

build/charts/antrea/values.yaml Outdated Show resolved Hide resolved

jianjuns reviewed May 18, 2022

View reviewed changes

build/charts/antrea/values.yaml Outdated Show resolved Hide resolved

build/charts/antrea/conf/antrea-controller.conf Outdated Show resolved Hide resolved

cmd/antrea-agent/agent.go Outdated Show resolved Hide resolved

xliuxu force-pushed the ipsec-cert branch 2 times, most recently from 7b3fc2c to ec94ce3 Compare May 19, 2022 15:14

xliuxu force-pushed the ipsec-cert branch from c2d2b11 to 05aba2a Compare May 27, 2022 04:45

xliuxu force-pushed the ipsec-cert branch from 05aba2a to 76f00b6 Compare May 27, 2022 05:56

xliuxu force-pushed the ipsec-cert branch 2 times, most recently from d29d0c9 to 8cc89f4 Compare May 27, 2022 09:01

tnqn reviewed May 27, 2022

View reviewed changes

cmd/antrea-agent/agent.go Outdated Show resolved Hide resolved

xliuxu force-pushed the ipsec-cert branch 2 times, most recently from 82e6835 to 4d9392d Compare May 30, 2022 02:38

tnqn reviewed May 30, 2022

View reviewed changes

pkg/agent/controller/ipseccertificate/ipsec_certificate_controller.go Outdated Show resolved Hide resolved

xliuxu force-pushed the ipsec-cert branch 2 times, most recently from dbabdac to 60e1db2 Compare May 30, 2022 03:41

tnqn reviewed May 30, 2022

View reviewed changes

pkg/agent/controller/noderoute/node_route_controller.go Outdated Show resolved Hide resolved

xliuxu force-pushed the ipsec-cert branch from 60e1db2 to 9b0f534 Compare May 30, 2022 04:54

tnqn previously approved these changes May 30, 2022

View reviewed changes

xliuxu dismissed tnqn’s stale review via a9d57fb May 30, 2022 08:48

xliuxu force-pushed the ipsec-cert branch from 9b0f534 to a9d57fb Compare May 30, 2022 08:48

tnqn approved these changes May 30, 2022

View reviewed changes

tnqn merged commit 3783595 into antrea-io:main May 31, 2022

xliuxu deleted the ipsec-cert branch May 31, 2022 03:43

wenyingd mentioned this pull request Jun 1, 2022

Antrea Agent is crashed on Windows #3848

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support IPsec Certificate-based Authentication #3778

Support IPsec Certificate-based Authentication #3778

xliuxu commented May 13, 2022 •

edited

Loading

codecov-commenter commented May 17, 2022 •

edited

Loading

jianjuns left a comment

xliuxu commented May 18, 2022

xliuxu commented May 27, 2022

xliuxu commented May 27, 2022

tnqn left a comment

tnqn commented May 30, 2022

xliuxu commented May 30, 2022

xliuxu commented May 30, 2022

tnqn commented May 30, 2022

xliuxu commented May 30, 2022

xliuxu commented May 31, 2022

xliuxu commented May 31, 2022

xliuxu commented May 31, 2022

Support IPsec Certificate-based Authentication #3778

Support IPsec Certificate-based Authentication #3778

Conversation

xliuxu commented May 13, 2022 • edited Loading

codecov-commenter commented May 17, 2022 • edited Loading

Codecov Report

jianjuns left a comment

Choose a reason for hiding this comment

xliuxu commented May 18, 2022

xliuxu commented May 27, 2022

xliuxu commented May 27, 2022

tnqn left a comment

Choose a reason for hiding this comment

tnqn commented May 30, 2022

xliuxu commented May 30, 2022

xliuxu commented May 30, 2022

tnqn commented May 30, 2022

xliuxu commented May 30, 2022

xliuxu commented May 31, 2022

xliuxu commented May 31, 2022

xliuxu commented May 31, 2022

xliuxu commented May 13, 2022 •

edited

Loading

codecov-commenter commented May 17, 2022 •

edited

Loading