Storage does not validate client certificate
Open
- Dominant language
- Go
- Stars
- 4
- Forks
- 22
- Avg merge
- 20h 43m
- Merged PRs (30d)
- 33
Description
The current implementation does not validate peer TLS certificates and any client can connect it and pull data. It should only be the Kubernetes API server that is allowed to do queries.
Contributor guide
Research direction
Inspect the storage service's TLS listener and client-certificate handling, starting at the connection setup and query entry point. Determine how the Kubernetes API server is identified, then verify the behavior with the existing test and connection paths. Done means untrusted clients are rejected while authorized Kubernetes API server queries still work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- api, authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100