Repository navigation
[security tests] add actor network and worker tunnel isolation tests. - #2822
Open
Siyan Shen (siyanshen) wants to merge 2 commits into
Open
Siyan Shen (siyanshen) wants to merge 2 commits into
Siyan Shen (siyanshen) wants to merge 2 commits into
Conversation
TestActorIsolation runs a victim and an attacker from the same template
in one atespace on a single-worker pool, so they differ only by name
and UID and take turns on the same worker.
- (moved from atespace isolation test)VictimDurableMarkerNotVisibleThroughAttackerMount: the attacker's
/data does not show the victim's durable marker.
- (moved from atespace isolation test)VictimHostStateNotReachableFromAttackerSandbox: the attacker cannot
read or write the victim's per-UID host directories or the worker
pod's credentials.
- VictimEphemeralStateNotPresentInAttackerSandbox: nothing the victim
left in /tmp, the writable rootfs layer, /dev, or an open fd is
visible to the attacker.
- ProjectedIdentityNotCapturedInSnapshot: an actor cloned from a
snapshot tag sees its own /run/ate identity, including through an
fd held open across the checkpoint.
- DeletedActorSnapshotsRemoved: deleting an actor empties its
snapshot prefix in object storage, and a same-named successor gets
a fresh UID and none of the old state.
TestCrossAtespaceIsolation keeps only the checks that need two
atespaces.
- (unchanged)TagScopedToAtespaceCannotSeedAnotherAtespace: an atespace-scoped
tag cannot seed an actor elsewhere but still works in its own.
Add four subtests to TestActorIsolation covering actor network namespace isolation, outbound actor certificate binding, and worker tunnel authentication and routing across worker reuse: - ActorNetworkIsolatedToPrivateVeth: verifies the actor sandbox sees only loopback and its private point-to-point veth (eth0 at 169.254.17.2/30), never the worker pod's CNI IP or host-side veth, and cannot be reached directly on the worker pod's port 80. - MintedActorCertificateBoundToAssignedActor: verifies outbound traffic from a reused worker authenticates to the egress gateway as the currently assigned actor (via gateway-injected actor JWT claims and gateway access logs), and that attempting to overwrite /run/ate/actor-id or /run/ate/actor-uid inside the sandbox is refused and cannot spoof the previous actor's identity. - OnlyRouterCanOpenWorkerTunnel: verifies the worker's atunnel listener accepts mTLS connections presenting atenet-router's pod-identity certificate while rejecting a valid pod-identity certificate from a non-router workload with a bad-certificate TLS alert. - WorkerTunnelForwardsOnlyToAssignedActor: verifies a reused worker's atunnel serves requests targeting the currently assigned actor (200 OK) and rejects requests targeting the previously hosted actor with 421 Misdirected Request and X-Ate-Assignment-Stale: true.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add four subtests to TestActorIsolation covering actor network isolation, outbound actor certificate binding, and worker tunnel authentication and routing across worker reuse.
ActorNetworkIsolatedToPrivateVeth: verifies the actor sandbox sees only loopback and its private point-to-point veth (eth0 at 169.254.17.2/30), never the worker pod's CNI IP or host-side veth, and cannot be reached directly on the worker pod's port 80.
MintedActorCertificateBoundToAssignedActor: verifies outbound traffic from a reused worker authenticates to the egress gateway as the currently assigned actor (via gateway-injected actor JWT claims and gateway access logs), and that attempting to overwrite /run/ate/actor-id or /run/ate/actor-uid inside the sandbox is refused and cannot spoof the previous actor's identity.
OnlyRouterCanOpenWorkerTunnel: verifies the worker's atunnel listener accepts mTLS connections presenting atenet-router's pod-identity certificate while rejecting a valid pod-identity certificate from a non-router workload with a bad-certificate TLS alert.
WorkerTunnelForwardsOnlyToAssignedActor: verifies a reused worker's atunnel serves requests targeting the currently assigned actor (200 OK) and rejects requests targeting the previously hosted actor with 421 Misdirected Request and X-Ate-Assignment-Stale: true.
Breaking change
Fixes #<issue_number_goes_here>