add an extend apiserver as the gateway

[aylei]

add an extend apiserver as the gateway

[jseguillon]

Maybe we could imagine an operator pattern waiting for new debug session asked via CRDs ? CRDs have full RBAC control and the operator could secure things enough with a service account and a Pod Security Policy.
Maybe also some annotations on the pod to expliclty authorize debugging (meaning that if you can modify this annotation, then it's ok to debug this pod) ?

[kklin]

JOOC, how are you planning on doing authentication? Is it possible to piggy-back off of RBAC and have users authenticate with the user in their kubeconfig? Or will you need to implement your own authentication flow?

I've been thinking about this for a project I'm working on, so would love to hear your thoughts!

[kklin]

Ah, or are you planning on using this thing? https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/

There's so many concepts in Kubernetes..

[aylei]

To be honest, I am not familiar with authz & authn in kubernetes. But yes, I plan to build an Extension API Server to serve as the gateway for kubectl-debug, and the idea is mainly inspired by this document. The key API to integrate with Kubernetes RBAC is SubjectAccessReview.

The same mechanism can be implemented in the agent, too. Kubelet does so for node resources.

[kklin]

Ah that looks really interesting, thanks. Looking forward to reading more.

…

On Jan 2, 2019, at 11:51 PM, Yeh-lei Wu ***@***.***> wrote: To be honest, I am not familiar with authz & authn in kubernetes. But yes, I plan to build an Extension API Server to serve as the gateway for kubectl-debug, and the idea is mainly inspired by the this document. The key API to integrate with Kubernetes RBAC is SubjectAccessReview. The same mechanism can be implemented in the agent, too. Kubelet does so for node resources. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[aylei]

@jseguillon Great idea at a glance! I will carefully consider this idea days after.