Bug 1701408
| Summary: | [DOCS] Certificate Authority x.509 certificate is stored unencrypted and available to all IAM users in the account including AWS support | ||
|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Chris Callegari <ccallega> |
| Component: | Documentation | Assignee: | Kathryn Alexander <kalexand> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Johnny Liu <jialiu> |
| Severity: | medium | Docs Contact: | Vikram Goyal <vigoyal> |
| Priority: | medium | ||
| Version: | 4.1.0 | CC: | aos-bugs, jokerman, mmccomas, scuppett, wking |
| Target Milestone: | --- | ||
| Target Release: | 4.1.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-05-09 14:13:30 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Chris Callegari
2019-04-18 21:31:45 UTC
Some discussion in [1], but basically: 1. There's no security concern about leaking *certificates*, as long as you don't leak the keys. Certificates get served to anyone who sends an HTTPS request to the encrypted endpoint anyway, they aren't private. I'm not aware of any leak concerns with information that goes into the CloudFormation templates. 2. The bootstrap Ignition config does contain secrets like X.509 keys. But you can serve it from any location you like, it doesn't have to be S3. For example, in CI we serve it to the cluster under test from a Service in the CI cluster [2]. At some point, discussion about locking down an S3 bucket is going to distract from the point of getting your cluster up. As long as we don't pitch it as "this is the 100% safe and secure method for putting the bootstrap Ignition config on S3", I'm fine with cutting corners. Would wiggle wording to that effect around [3] be satisfactory? [1]: https://github.com/openshift/openshift-docs/pull/14241#discussion_r276795529 [2]: https://github.com/openshift/release/pull/3440/commits/7d4e4349bed16d03a199518e87d30daafdc26b76#diff-2b1b845b92f8062711789a2bfdb27290R403 [3]: https://github.com/openshift/openshift-docs/pull/14241/files#diff-027942c942df17c3eb23ffd1cbb35e6dR30 I added some notes around here: https://github.com/openshift/openshift-docs/pull/14241/files#diff-027942c942df17c3eb23ffd1cbb35e6dR30 Trevor, Chris, will you PTAL? Trevor approved the text in the PR. Jianlin, will you PTAL and let me know if you agree that this issue is addressed? If not, I'll open a follow-up PR. The change is around here: https://github.com/openshift/openshift-docs/pull/14241/files#diff-027942c942df17c3eb23ffd1cbb35e6dR30 LGTM. Thank you! This change is live: https://docs.openshift.com/container-platform/4.1/installing/installing_aws_upi/installing-aws-upi.html#installation-creating-aws-bootstrap-installing-aws-upi CLOSED for a long time, so nobody needs info anymore. |