Workload Identity: Kubernetes Workload Attestation

[strideynet]

Closes #41892

Manifests used in manual testing:

# Required cluster role to allow spire-agent to query k8s API server
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tbot
rules:
  - apiGroups: [""]
    resources: ["pods","nodes","nodes/proxy"]
    verbs: ["get"]
---
# Binds above cluster role to spire-agent service account
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: tbot
subjects:
  - kind: ServiceAccount
    name: tbot
    namespace: default
roleRef:
  kind: ClusterRole
  name: tbot
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tbot
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: tbot-config-1
  namespace: default
data:
  tbot.yaml: |
    version: v2
    onboarding:
      join_method: kubernetes
      # ensure token is set to the name of the join token you created earlier
      token: workload-attestation-bot
    storage:
      # a memory destination is used for the bots own state since the kubernetes
      # join method does not require persistence.
      type: memory
    # ensure this is configured to the address of your Teleport Proxy Service.
    proxy_server: redacted
    services:
      - type: spiffe-workload-api
        listen: unix:///run/tbot/sockets/workload.sock
        attestor:
          kubernetes:
            enabled: true
            # If there's any configuration needed for the k8s attestor, it can
            # be added here - but it should work out of the box like this for
            # most clusters.
        svids:
          - path: /my-service
            rules:
              - kubernetes:
                  namespace: default
                  service_account: tbot
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: tbot
spec:
  selector:
      matchLabels:
        app: tbot
  template:
    metadata:
      labels:
        app: tbot
    spec:
      securityContext:
        runAsUser: 0
        runAsGroup: 0
      hostPID: true
      containers:
        - name: tbot
          image: tbot-distroless
          imagePullPolicy: IfNotPresent
          securityContext:
            privileged: true
          args:
            - start
            - -c
            - /config/tbot.yaml
            - --log-format
            - json
          volumeMounts:
            - mountPath: /config
              name: config
            - mountPath: /var/run/secrets/tokens
              name: join-sa-token
            - name: tbot-sockets
              mountPath: /run/tbot/sockets
              readOnly: false
          env:
            - name: TELEPORT_NODE_NAME
              valueFrom:
                fieldRef:
                  fieldPath: spec.nodeName
            - name: KUBERNETES_TOKEN_PATH
              value: /var/run/secrets/tokens/join-sa-token
      serviceAccountName: tbot
      volumes:
        - name: tbot-sockets
          hostPath:
            path: /run/tbot/sockets
            type: DirectoryOrCreate
        - name: config
          configMap:
            name: tbot-config-1
        - name: join-sa-token
          projected:
            sources:
              - serviceAccountToken:
                  path: join-sa-token
                  # 600 seconds is the minimum that Kubernetes supports. We
                  # recommend this value is used.
                  expirationSeconds: 600
                  # `example.teleport.sh` must be replaced with the name of
                  # your Teleport cluster.
                  audience: redacted

Tested on GCP and my local docker desktop cluster.

changelog: Added support for Kubernetes Workload Attestation into Teleport Workload Identity to allow the authentication of pods running within Kubernetes without secrets.

[strideynet]

I'd like to get this manually tested on EKS and AKS before releasing this.

[timothyb89]

We discussed my issue offline, turns out my bot role was misconfigured. spiffe-helper is happily issuing SVIDs now that there is in fact a valid allow: rule for the path.

LGTM otherwise!

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Failed	Vulnerabilities	1   0   0   0	View in Orca

☢️ The following Vulnerabilities (CVEs) have been detected

	PACKAGE	FILE	CVE ID	INSTALLED VERSION	FIXED VERSION
	github.com/docker/docker	./go.mod	CVE-2024-41110	26.1.1+incompatible	23.0.14, 26.1.4, 27.1.0	View in code

[strideynet]

Orca Security Scan Summary

Status Check Issues by priority
Passed Infrastructure as Code 0   0   0   0 View in Orca
Passed Secrets 0   0   0   0 View in Orca
Failed Vulnerabilities 1   0   0   0 View in Orca
☢️ The following Vulnerabilities (CVEs) have been detected

PACKAGE FILE CVE ID INSTALLED VERSION FIXED VERSION
github.com/docker/docker ./go.mod CVE-2024-41110 26.1.1+incompatible 23.0.14, 26.1.4, 27.1.0 View in code

This is fixed on master, will merge master in this branch.

[public-teleport-github-review-bot]

@strideynet See the table below for backport results.

Branch	Result
branch/v15	Failed
branch/v16	Failed