Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Should CP disconnect DP when token is expired or revoked? #1298

Open
jakubdyszkiewicz opened this issue Nov 29, 2021 · 14 comments
Open

Should CP disconnect DP when token is expired or revoked? #1298

jakubdyszkiewicz opened this issue Nov 29, 2021 · 14 comments
Labels
kind/feature New feature triage/accepted The issue was reviewed and is complete enough to start working on it

Comments

@jakubdyszkiewicz
Copy link
Contributor

Description

Right now we authenticate the DP on the first DiscoveryRequest. Assuming that NodeID between DiscoveryRequest is stable, we don't need to authenticate it again.

With this PR kumahq/kuma#3376 we introduced expiration and revocation.

I think we should disconnect DP when the token is revoked but what about the expired token?
@jakubdyszkiewicz jakubdyszkiewicz added triage/pending This issue will be looked at on the next triage meeting kind/feature New feature labels Nov 29, 2021
@lahabana
Copy link
Contributor

Revocation and expiration should be the same.
Right approach is closing the connection straight away.

We probably also should expose data to the dataplane-insight that shows signing key serial number and expiration date.

@lahabana lahabana added triage/accepted The issue was reviewed and is complete enough to start working on it and removed triage/pending This issue will be looked at on the next triage meeting labels Nov 29, 2021
@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Dec 30, 2021
@github-actions
Copy link
Contributor

This issue was inactive for 30 days it will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant please comment on it promptly or attend the next triage meeting.

@lahabana lahabana removed the triage/stale Inactive for some time. It will be triaged again label Jul 5, 2022
@gregoryhunt
Copy link

I would like to bring this issue back to life. I think it is important for a healthy mesh.

@jakubdyszkiewicz jakubdyszkiewicz mentioned this issue Jul 29, 2022
Merged
9 tasks
@lahabana
Copy link
Contributor

lahabana commented Aug 2, 2022

@jakubdyszkiewicz is this fixed now?

@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Nov 1, 2022
@github-actions
Copy link
Contributor

github-actions bot commented Nov 1, 2022

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@lahabana lahabana removed the triage/stale Inactive for some time. It will be triaged again label Nov 2, 2022
@github-actions
Copy link
Contributor

github-actions bot commented Feb 1, 2023

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Feb 1, 2023
@jakubdyszkiewicz
Copy link
Contributor Author

Partially fixed by kumahq/kuma#4685

We now auth with every single DiscoveryRequest, so CP will disconnect DPP with a revoked or expired token on the next DiscoveryRequest. That means that if there is no new config, DPP can still be connected for some time before it happens.

What we should consider is whether we want to immediately disconnect DPP whose token expired or the token we just revoked. Technically dropping the connection immediately does not change much from the DPP perspective. Even if we drop the connection sooner, Envoy will still have the config.

@jakubdyszkiewicz jakubdyszkiewicz added triage/pending This issue will be looked at on the next triage meeting triage/accepted The issue was reviewed and is complete enough to start working on it and removed triage/accepted The issue was reviewed and is complete enough to start working on it triage/stale Inactive for some time. It will be triaged again triage/pending This issue will be looked at on the next triage meeting labels Feb 1, 2023
@jakubdyszkiewicz
Copy link
Contributor Author

Triage: let's add to docs that you need to disconnect DP from CP https://kuma.io/docs/2.1.x/security/dp-auth/#token-revocation

@lahabana lahabana transferred this issue from kumahq/kuma Apr 11, 2023
@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Jul 11, 2023
@github-actions
Copy link
Contributor

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@lahabana lahabana removed the triage/stale Inactive for some time. It will be triaged again label Jul 11, 2023
@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Oct 10, 2023
@github-actions
Copy link
Contributor

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@lahabana lahabana removed the triage/stale Inactive for some time. It will be triaged again label Oct 10, 2023
@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Jan 9, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Jan 9, 2024

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@lukidzi lukidzi removed the triage/stale Inactive for some time. It will be triaged again label Jan 9, 2024
@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Apr 9, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Apr 9, 2024

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@lukidzi lukidzi removed the triage/stale Inactive for some time. It will be triaged again label Apr 10, 2024
@github-actions GitHub Actions
Copy link
Contributor

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Jul 10, 2024
@jakubdyszkiewicz jakubdyszkiewicz removed the triage/stale Inactive for some time. It will be triaged again label Jul 10, 2024
@github-actions github-actions bot added the triage/stale Inactive for some time. It will be triaged again label Oct 9, 2024
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 9, 2024

This issue was inactive for 90 days. It will be reviewed in the next triage meeting and might be closed.
If you think this issue is still relevant, please comment on it or attend the next triage meeting.

@lukidzi lukidzi removed the triage/stale Inactive for some time. It will be triaged again label Oct 21, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
kind/feature New feature triage/accepted The issue was reviewed and is complete enough to start working on it
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@lahabana @jakubdyszkiewicz @lukidzi @gregoryhunt