Enforcing security policies and attestation on edge infrastructure
Examples of the present disclosure describe systems and methods for. In some examples, a software agent collects data from a node, such as logs or monitoring information, and provides the data to a controller. The controller assesses the attestation state and the configuration drift of the node. In some examples, the controller applies a taint to the node, which may indicate a condition or constraint on the node. A scheduler manages the workloads on the node based on the attestation state, the configuration drift, and in some examples, the taint of the node. The scheduler decides whether to schedule a workload to the node, evict a workload from the node, or keep a workload on the node depending on the attestation state and configuration drift of the node, for example, whether the workload has a toleration for the taint of the node.
1 . A method comprising:
accessing, by a software agent implemented by a node, event data for the node;
determining an attestation state of the node by comparing the event data to one or more predefined values for the event data, the attestation state representing a trustworthiness of the node, wherein determining the attestation state comprises providing, by the software agent, an attestation status report, wherein the software agent determines a security score for the node based on the attestation state and a configuration drift for the node, the security score indicating whether the node is healthy;
applying a taint to the node based on the attestation state, the taint representing an operational constraint for the node; and
managing workloads associated with the node based on the taint, wherein managing the workloads comprises one of:
evicting a currently executing workload from the node based on the currently executing workload being incompatible with the taint; or
scheduling a new workload to execute on the node based on the new workload being compatible with the taint.
2 . The method of claim 1 , wherein the currently executing workload is a member of a pod implemented by the node.
3 . The method of claim 2 , wherein the pod includes a plurality of workloads having at least one of shared storage or shared network resources.
4 . The method of claim 1 , wherein the one or more predefined values for the event data are defined by at least one security policy stored by the node.
5 . The method of claim 4 , wherein the software agent and the at least one security policy are provided to the node as part of an initialization process for the node.
6 . The method of claim 1 , wherein the node is a confidential node that ensure that data and applications implemented within the node remains private.
7 . The method of claim 1 , wherein the event data is collected from at least one of Trusted Platform Module (TPM) event logs or Platform Configuration Register (PCR) data.
8 . The method of claim 1 , wherein determining the attestation state of the node comprises obtaining a web token response from an attestation service.
9 . A system comprising:
a processor; and
memory comprising executable instructions that, when executed, performs operations comprising:
receiving data from a node;
determining, for the node and based on the data, an attestation state indicating a security score of the node, wherein determining the attestation state comprises providing, by a software agent implemented by the node, an attestation status report to a controller based on the web token response;
calculating a configuration drift for the node, wherein the configuration drift indicates a deviation of the node from a predefined security configuration, and wherein the software agent determines the security score based on the attestation state and the configuration drift, the security score indicating whether the node is healthy;
applying a taint to the node based on the attestation state and the configuration drift of the node, wherein the taint represents an operational constraint for the node; and
scheduling a workload on the node based on at least one of the attestation state, the configuration drift, or the taint.
10 . The system of claim 9 , wherein the workload includes a toleration for the taint, the toleration being a property that identifies whether the workload is configured to handle the operational constraint.
11 . The system of claim 9 , wherein determining the attestation state for the node comprises receiving a web token response from an attestation service.
12 . The system of claim 11 , wherein the web token response includes the attestation state and the configuration drift.
13 . The system of claim 11 , wherein the software agent provides the attestation status report to a controller based on the web token response.
14 . The system of claim 9 , the operations further comprising:
determining that the configuration drift indicates the node is not healthy; and
in response to determining that the configuration drift indicates the node is not healthy, remediating the node.
15 . The system of claim 14 , wherein remediating the node comprises setting a current security configuration of the node to the predefined security configuration.
16 . A device comprising:
a processor; and
memory comprising executable instructions that, when executed, perform operations comprising:
accessing, by a software agent implemented by a node, event data for the node;
determining an attestation state of the node by comparing the event data to known values for the event data, the attestation state representing a trustworthiness of the node, wherein determining the attestation state comprises providing, by the software agent, an attestation status report;
determining a configuration drift of the node, the configuration drift indicating a deviation of the node from a known security configuration, wherein the software agent determines a security score for the node based on the attestation state and the configuration drift, the security score indicating whether the node is healthy;
applying a taint to the node based on at least one of the attestation state or the configuration drift, the taint representing an operational constraint for the node; and
based on the taint, performing at least one of:
evicting a currently executing workload from the node based on the currently executing workload being incompatible with the taint; or
preventing new workloads that are incompatible with the taint from being scheduled to execute on the node.
17 . The device of claim 16 , wherein determining the attestation state comprises evaluating one or more event logs to determine whether the node booted correctly.
18 . The device of claim 16 , wherein determining the configuration drift comprises identifying whether first values in a current security configuration for the node exceed a threshold difference from second values in the known security configuration.
19 . The device of claim 16 , wherein the currently executing workload is a member of a pod implemented by the node, the pod including a plurality of workloads having at least one of shared storage or shared network resources.
20 . The device of claim 16 , wherein the software agent and the at least one security policy are provided to the node as part of an initialization process for the node.