2019-10-18 20:52:28 +00:00
|
|
|
package provisioner
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
|
|
|
"crypto/ecdsa"
|
2020-08-05 23:02:46 +00:00
|
|
|
"crypto/ed25519"
|
2019-10-18 20:52:28 +00:00
|
|
|
"crypto/rsa"
|
|
|
|
"crypto/x509"
|
|
|
|
"encoding/pem"
|
2019-12-20 21:30:05 +00:00
|
|
|
"net/http"
|
2019-10-18 20:52:28 +00:00
|
|
|
|
|
|
|
"github.com/pkg/errors"
|
2022-03-24 11:36:12 +00:00
|
|
|
|
2020-08-24 21:44:11 +00:00
|
|
|
"go.step.sm/crypto/jose"
|
2020-08-14 22:33:50 +00:00
|
|
|
"go.step.sm/crypto/pemutil"
|
2020-08-10 18:26:51 +00:00
|
|
|
"go.step.sm/crypto/sshutil"
|
2020-08-05 23:02:46 +00:00
|
|
|
"go.step.sm/crypto/x509util"
|
2022-03-24 11:36:12 +00:00
|
|
|
|
|
|
|
"github.com/smallstep/certificates/authority/policy"
|
|
|
|
"github.com/smallstep/certificates/errs"
|
2019-10-18 20:52:28 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// NOTE: There can be at most one kubernetes service account provisioner configured
|
|
|
|
// per instance of step-ca. This is due to a lack of distinguishing information
|
|
|
|
// contained in kubernetes service account tokens.
|
|
|
|
|
|
|
|
const (
|
|
|
|
// K8sSAName is the default name used for kubernetes service account provisioners.
|
|
|
|
K8sSAName = "k8sSA-default"
|
|
|
|
// K8sSAID is the default ID for kubernetes service account provisioners.
|
|
|
|
K8sSAID = "k8ssa/" + K8sSAName
|
|
|
|
k8sSAIssuer = "kubernetes/serviceaccount"
|
|
|
|
)
|
|
|
|
|
|
|
|
// jwtPayload extends jwt.Claims with step attributes.
|
|
|
|
type k8sSAPayload struct {
|
|
|
|
jose.Claims
|
|
|
|
Namespace string `json:"kubernetes.io/serviceaccount/namespace,omitempty"`
|
|
|
|
SecretName string `json:"kubernetes.io/serviceaccount/secret.name,omitempty"`
|
|
|
|
ServiceAccountName string `json:"kubernetes.io/serviceaccount/service-account.name,omitempty"`
|
|
|
|
ServiceAccountUID string `json:"kubernetes.io/serviceaccount/service-account.uid,omitempty"`
|
|
|
|
}
|
|
|
|
|
|
|
|
// K8sSA represents a Kubernetes ServiceAccount provisioner; an
|
|
|
|
// entity trusted to make signature requests.
|
|
|
|
type K8sSA struct {
|
2019-10-28 18:50:43 +00:00
|
|
|
*base
|
2022-03-10 02:43:45 +00:00
|
|
|
ID string `json:"-"`
|
|
|
|
Type string `json:"type"`
|
|
|
|
Name string `json:"name"`
|
|
|
|
PubKeys []byte `json:"publicKeys,omitempty"`
|
|
|
|
Claims *Claims `json:"claims,omitempty"`
|
|
|
|
Options *Options `json:"options,omitempty"`
|
2019-10-18 20:52:28 +00:00
|
|
|
//kauthn kauthn.AuthenticationV1Interface
|
2022-02-01 13:58:13 +00:00
|
|
|
pubKeys []interface{}
|
2022-03-24 11:36:12 +00:00
|
|
|
ctl *Controller
|
2022-03-08 12:26:07 +00:00
|
|
|
x509Policy policy.X509Policy
|
|
|
|
sshHostPolicy policy.HostPolicy
|
2022-04-01 13:37:48 +00:00
|
|
|
sshUserPolicy policy.UserPolicy
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// GetID returns the provisioner unique identifier. The name and credential id
|
|
|
|
// should uniquely identify any K8sSA provisioner.
|
|
|
|
func (p *K8sSA) GetID() string {
|
2021-05-20 01:23:20 +00:00
|
|
|
if p.ID != "" {
|
|
|
|
return p.ID
|
|
|
|
}
|
|
|
|
return p.GetIDForToken()
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetIDForToken returns an identifier that will be used to load the provisioner
|
|
|
|
// from a token.
|
|
|
|
func (p *K8sSA) GetIDForToken() string {
|
2019-10-18 20:52:28 +00:00
|
|
|
return K8sSAID
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetTokenID returns an unimplemented error and does not use the input ott.
|
|
|
|
func (p *K8sSA) GetTokenID(ott string) (string, error) {
|
|
|
|
return "", errors.New("not implemented")
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetName returns the name of the provisioner.
|
|
|
|
func (p *K8sSA) GetName() string {
|
|
|
|
return p.Name
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetType returns the type of provisioner.
|
|
|
|
func (p *K8sSA) GetType() Type {
|
|
|
|
return TypeK8sSA
|
|
|
|
}
|
|
|
|
|
|
|
|
// GetEncryptedKey returns false, because the kubernetes provisioner does not
|
|
|
|
// have access to the private key.
|
|
|
|
func (p *K8sSA) GetEncryptedKey() (string, string, bool) {
|
|
|
|
return "", "", false
|
|
|
|
}
|
|
|
|
|
|
|
|
// Init initializes and validates the fields of a K8sSA type.
|
|
|
|
func (p *K8sSA) Init(config Config) (err error) {
|
2022-01-25 15:45:25 +00:00
|
|
|
|
2019-10-18 20:52:28 +00:00
|
|
|
switch {
|
|
|
|
case p.Type == "":
|
|
|
|
return errors.New("provisioner type cannot be empty")
|
|
|
|
case p.Name == "":
|
|
|
|
return errors.New("provisioner name cannot be empty")
|
|
|
|
}
|
|
|
|
|
|
|
|
if p.PubKeys != nil {
|
|
|
|
var (
|
|
|
|
block *pem.Block
|
|
|
|
rest = p.PubKeys
|
|
|
|
)
|
|
|
|
for rest != nil {
|
|
|
|
block, rest = pem.Decode(rest)
|
|
|
|
if block == nil {
|
|
|
|
break
|
|
|
|
}
|
|
|
|
key, err := pemutil.ParseKey(pem.EncodeToMemory(block))
|
|
|
|
if err != nil {
|
2021-05-03 19:48:20 +00:00
|
|
|
return errors.Wrapf(err, "error parsing public key in provisioner '%s'", p.GetName())
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
switch q := key.(type) {
|
|
|
|
case *rsa.PublicKey, *ecdsa.PublicKey, ed25519.PublicKey:
|
|
|
|
default:
|
2021-05-03 19:48:20 +00:00
|
|
|
return errors.Errorf("Unexpected public key type %T in provisioner '%s'", q, p.GetName())
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
p.pubKeys = append(p.pubKeys, key)
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
// TODO: Use the TokenReview API if no pub keys provided. This will need to
|
|
|
|
// be configured with additional attributes in the K8sSA struct for
|
|
|
|
// connecting to the kubernetes API server.
|
|
|
|
return errors.New("K8s Service Account provisioner cannot be initialized without pub keys")
|
|
|
|
}
|
|
|
|
/*
|
|
|
|
// NOTE: Not sure if we should be doing this initialization here ...
|
|
|
|
// If you have a k8sSA provisioner defined in your config, but you're not
|
|
|
|
// in a kubernetes pod then your CA will fail to startup. Maybe we just postpone
|
|
|
|
// creating the authn until token validation time?
|
|
|
|
if err := checkAccess(k8s.AuthorizationV1()); err != nil {
|
|
|
|
return errors.Wrapf(err, "error verifying access to kubernetes authz service for provisioner %s", p.GetID())
|
|
|
|
}
|
|
|
|
|
|
|
|
p.kauthn = k8s.AuthenticationV1()
|
|
|
|
*/
|
|
|
|
|
2022-01-03 11:25:24 +00:00
|
|
|
// Initialize the x509 allow/deny policy engine
|
2022-03-08 12:26:07 +00:00
|
|
|
if p.x509Policy, err = policy.NewX509PolicyEngine(p.Options.GetX509Options()); err != nil {
|
2022-01-03 11:25:24 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-04-01 13:37:48 +00:00
|
|
|
// Initialize the SSH allow/deny policy engine for user certificates
|
|
|
|
if p.sshUserPolicy, err = policy.NewSSHUserPolicyEngine(p.Options.GetSSHOptions()); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-02-01 13:58:13 +00:00
|
|
|
// Initialize the SSH allow/deny policy engine for host certificates
|
2022-03-08 12:26:07 +00:00
|
|
|
if p.sshHostPolicy, err = policy.NewSSHHostPolicyEngine(p.Options.GetSSHOptions()); err != nil {
|
2022-01-03 11:25:24 +00:00
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2022-03-10 02:43:45 +00:00
|
|
|
p.ctl, err = NewController(p, p.Claims, config)
|
|
|
|
return
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// authorizeToken performs common jwt authorization actions and returns the
|
|
|
|
// claims for case specific downstream parsing.
|
|
|
|
// e.g. a Sign request will auth/validate different fields than a Revoke request.
|
|
|
|
func (p *K8sSA) authorizeToken(token string, audiences []string) (*k8sSAPayload, error) {
|
|
|
|
jwt, err := jose.ParseSigned(token)
|
|
|
|
if err != nil {
|
2019-12-20 21:30:05 +00:00
|
|
|
return nil, errs.Wrap(http.StatusUnauthorized, err,
|
|
|
|
"k8ssa.authorizeToken; error parsing k8sSA token")
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
var (
|
|
|
|
valid bool
|
|
|
|
claims k8sSAPayload
|
|
|
|
)
|
|
|
|
if p.pubKeys == nil {
|
2020-01-24 06:04:34 +00:00
|
|
|
return nil, errs.Unauthorized("k8ssa.authorizeToken; k8sSA TokenReview API integration not implemented")
|
2019-10-18 20:52:28 +00:00
|
|
|
/* NOTE: We plan to support the TokenReview API in a future release.
|
|
|
|
Below is some code that should be useful when we prioritize
|
|
|
|
this integration.
|
|
|
|
|
|
|
|
tr := kauthnApi.TokenReview{Spec: kauthnApi.TokenReviewSpec{Token: string(token)}}
|
|
|
|
rvw, err := p.kauthn.TokenReviews().Create(&tr)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error using kubernetes TokenReview API")
|
|
|
|
}
|
|
|
|
if rvw.Status.Error != "" {
|
|
|
|
return nil, errors.Errorf("error from kubernetes TokenReviewAPI: %s", rvw.Status.Error)
|
|
|
|
}
|
|
|
|
if !rvw.Status.Authenticated {
|
|
|
|
return nil, errors.New("error from kubernetes TokenReviewAPI: token could not be authenticated")
|
|
|
|
}
|
|
|
|
if err = jwt.UnsafeClaimsWithoutVerification(&claims); err != nil {
|
|
|
|
return nil, errors.Wrap(err, "error parsing claims")
|
|
|
|
}
|
|
|
|
*/
|
|
|
|
}
|
|
|
|
for _, pk := range p.pubKeys {
|
|
|
|
if err = jwt.Claims(pk, &claims); err == nil {
|
|
|
|
valid = true
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if !valid {
|
2020-01-24 06:04:34 +00:00
|
|
|
return nil, errs.Unauthorized("k8ssa.authorizeToken; error validating k8sSA token and extracting claims")
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// According to "rfc7519 JSON Web Token" acceptable skew should be no
|
|
|
|
// more than a few minutes.
|
|
|
|
if err = claims.Validate(jose.Expected{
|
|
|
|
Issuer: k8sSAIssuer,
|
|
|
|
}); err != nil {
|
2019-12-20 21:30:05 +00:00
|
|
|
return nil, errs.Wrap(http.StatusUnauthorized, err, "k8ssa.authorizeToken; invalid k8sSA token claims")
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if claims.Subject == "" {
|
2020-01-24 06:04:34 +00:00
|
|
|
return nil, errs.Unauthorized("k8ssa.authorizeToken; k8sSA token subject cannot be empty")
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return &claims, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// AuthorizeRevoke returns an error if the provisioner does not have rights to
|
|
|
|
// revoke the certificate with serial number in the `sub` property.
|
2019-10-28 18:50:43 +00:00
|
|
|
func (p *K8sSA) AuthorizeRevoke(ctx context.Context, token string) error {
|
2022-03-10 02:43:45 +00:00
|
|
|
_, err := p.authorizeToken(token, p.ctl.Audiences.Revoke)
|
2019-12-20 21:30:05 +00:00
|
|
|
return errs.Wrap(http.StatusInternalServerError, err, "k8ssa.AuthorizeRevoke")
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// AuthorizeSign validates the given token.
|
|
|
|
func (p *K8sSA) AuthorizeSign(ctx context.Context, token string) ([]SignOption, error) {
|
2022-03-10 02:43:45 +00:00
|
|
|
claims, err := p.authorizeToken(token, p.ctl.Audiences.Sign)
|
2020-07-15 01:39:31 +00:00
|
|
|
if err != nil {
|
2019-12-20 21:30:05 +00:00
|
|
|
return nil, errs.Wrap(http.StatusInternalServerError, err, "k8ssa.AuthorizeSign")
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
2020-07-15 01:39:31 +00:00
|
|
|
// Add some values to use in custom templates.
|
|
|
|
data := x509util.NewTemplateData()
|
|
|
|
data.SetCommonName(claims.ServiceAccountName)
|
2020-07-21 18:41:36 +00:00
|
|
|
if v, err := unsafeParseSigned(token); err == nil {
|
|
|
|
data.SetToken(v)
|
|
|
|
}
|
2020-07-15 01:39:31 +00:00
|
|
|
|
2020-07-13 21:36:59 +00:00
|
|
|
// Certificate templates: on K8sSA the default template is the certificate
|
|
|
|
// request.
|
2020-09-21 19:49:16 +00:00
|
|
|
templateOptions, err := CustomTemplateOptions(p.Options, data, x509util.DefaultAdminLeafTemplate)
|
2020-07-13 21:36:59 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, errs.Wrap(http.StatusInternalServerError, err, "k8ssa.AuthorizeSign")
|
|
|
|
}
|
|
|
|
|
2019-10-18 20:52:28 +00:00
|
|
|
return []SignOption{
|
2022-03-22 02:21:40 +00:00
|
|
|
p,
|
2020-07-13 21:36:59 +00:00
|
|
|
templateOptions,
|
2019-10-18 20:52:28 +00:00
|
|
|
// modifiers / withOptions
|
|
|
|
newProvisionerExtensionOption(TypeK8sSA, p.Name, ""),
|
2022-03-10 02:43:45 +00:00
|
|
|
profileDefaultDuration(p.ctl.Claimer.DefaultTLSCertDuration()),
|
2019-10-18 20:52:28 +00:00
|
|
|
// validators
|
|
|
|
defaultPublicKeyValidator{},
|
2022-03-10 02:43:45 +00:00
|
|
|
newValidityValidator(p.ctl.Claimer.MinTLSCertDuration(), p.ctl.Claimer.MaxTLSCertDuration()),
|
2022-01-25 15:45:25 +00:00
|
|
|
newX509NamePolicyValidator(p.x509Policy),
|
2019-10-18 20:52:28 +00:00
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2019-11-06 23:53:16 +00:00
|
|
|
// AuthorizeRenew returns an error if the renewal is disabled.
|
|
|
|
func (p *K8sSA) AuthorizeRenew(ctx context.Context, cert *x509.Certificate) error {
|
2022-03-10 02:43:45 +00:00
|
|
|
return p.ctl.AuthorizeRenew(ctx, cert)
|
2019-10-18 20:52:28 +00:00
|
|
|
}
|
|
|
|
|
2019-11-06 23:53:16 +00:00
|
|
|
// AuthorizeSSHSign validates an request for an SSH certificate.
|
|
|
|
func (p *K8sSA) AuthorizeSSHSign(ctx context.Context, token string) ([]SignOption, error) {
|
2022-03-10 02:43:45 +00:00
|
|
|
if !p.ctl.Claimer.IsSSHCAEnabled() {
|
2021-05-03 19:48:20 +00:00
|
|
|
return nil, errs.Unauthorized("k8ssa.AuthorizeSSHSign; sshCA is disabled for k8sSA provisioner '%s'", p.GetName())
|
2019-11-06 23:53:16 +00:00
|
|
|
}
|
2022-03-10 02:43:45 +00:00
|
|
|
claims, err := p.authorizeToken(token, p.ctl.Audiences.SSHSign)
|
2020-07-30 02:26:46 +00:00
|
|
|
if err != nil {
|
2019-12-20 21:30:05 +00:00
|
|
|
return nil, errs.Wrap(http.StatusInternalServerError, err, "k8ssa.AuthorizeSSHSign")
|
2019-11-06 23:53:16 +00:00
|
|
|
}
|
|
|
|
|
2020-07-30 02:26:46 +00:00
|
|
|
// Certificate templates.
|
|
|
|
// Set some default variables to be used in the templates.
|
|
|
|
data := sshutil.CreateTemplateData(sshutil.HostCert, claims.ServiceAccountName, []string{claims.ServiceAccountName})
|
|
|
|
if v, err := unsafeParseSigned(token); err == nil {
|
|
|
|
data.SetToken(v)
|
|
|
|
}
|
|
|
|
|
2020-07-31 01:44:52 +00:00
|
|
|
templateOptions, err := CustomSSHTemplateOptions(p.Options, data, sshutil.CertificateRequestTemplate)
|
2020-07-30 02:26:46 +00:00
|
|
|
if err != nil {
|
|
|
|
return nil, errs.Wrap(http.StatusInternalServerError, err, "k8ssa.AuthorizeSSHSign")
|
|
|
|
}
|
|
|
|
signOptions := []SignOption{templateOptions}
|
2019-11-06 23:53:16 +00:00
|
|
|
|
|
|
|
return append(signOptions,
|
2020-07-30 02:26:46 +00:00
|
|
|
// Require type, key-id and principals in the SignSSHOptions.
|
|
|
|
&sshCertOptionsRequireValidator{CertType: true, KeyID: true, Principals: true},
|
2019-11-06 23:53:16 +00:00
|
|
|
// Set the validity bounds if not set.
|
2022-03-10 02:43:45 +00:00
|
|
|
&sshDefaultDuration{p.ctl.Claimer},
|
2019-11-06 23:53:16 +00:00
|
|
|
// Validate public key
|
|
|
|
&sshDefaultPublicKeyValidator{},
|
|
|
|
// Validate the validity period.
|
2022-03-10 02:43:45 +00:00
|
|
|
&sshCertValidityValidator{p.ctl.Claimer},
|
2019-11-06 23:53:16 +00:00
|
|
|
// Require and validate all the default fields in the SSH certificate.
|
2020-01-24 06:04:34 +00:00
|
|
|
&sshCertDefaultValidator{},
|
2022-01-03 11:25:24 +00:00
|
|
|
// Ensure that all principal names are allowed
|
2022-04-01 13:37:48 +00:00
|
|
|
newSSHNamePolicyValidator(p.sshHostPolicy, p.sshUserPolicy),
|
2019-11-06 23:53:16 +00:00
|
|
|
), nil
|
|
|
|
}
|
|
|
|
|
2019-10-18 20:52:28 +00:00
|
|
|
/*
|
|
|
|
func checkAccess(authz kauthz.AuthorizationV1Interface) error {
|
|
|
|
r := &kauthzApi.SelfSubjectAccessReview{
|
|
|
|
Spec: kauthzApi.SelfSubjectAccessReviewSpec{
|
|
|
|
ResourceAttributes: &kauthzApi.ResourceAttributes{
|
|
|
|
Group: "authentication.k8s.io",
|
|
|
|
Version: "v1",
|
|
|
|
Resource: "tokenreviews",
|
|
|
|
Verb: "create",
|
|
|
|
},
|
|
|
|
},
|
|
|
|
}
|
|
|
|
rvw, err := authz.SelfSubjectAccessReviews().Create(r)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if !rvw.Status.Allowed {
|
|
|
|
return fmt.Errorf("Unable to create kubernetes token reviews: %s", rvw.Status.Reason)
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
*/
|