Securing connections between a networking and security controller and distributed agents in a container-based cluster
The disclosure provides a method for authenticating a network agent deployed in a networking environment. The method generally includes receiving, by a network controller in the networking environment, a name of an external node where the network agent is running and a token associated with the external node; in response to receiving the name of the external node, obtaining, by the network controller, a secret associated with the token; parsing, by the network controller, the secret to determine an expected external node name corresponding to the token; comparing the expected external node name with the received external node name; and trusting the network agent when the expected external node name and the received external node name match.
1. A method for authenticating a network agent deployed in a networking environment, comprising:
receiving, by a network controller in the networking environment, a name of an external node where the network agent is running and a token associated with the external node;
in response to receiving the name of the external node, obtaining, by the network controller, a secret associated with the token;
parsing, by the network controller, the secret to determine an expected external node name corresponding to the token;
comparing the expected external node name with the received external node name; and
trusting the network agent when the expected external node name and the received external node name match.
2. The method of claim 1 , further comprising:
receiving, by the network controller, a request from the network agent; and
accepting the request when the expected external node name and the received external node name match.
3. The method of claim 2 , wherein the network controller receives the name of the external node and the token associated with the external node with the request from the network agent.
4. The method of claim 1 , wherein:
the networking environment is divided into one or more first level isolation constructs,
each of the one or more first level isolation constructs is divided into one or more second level isolation constructs,
each of the one or more second level isolation constructs is divided into one or more virtual private clouds, and
the external node running the network agent is running in a first virtual private cloud of the one or more virtual private clouds.
5. The method of claim 4 , wherein:
an application programming interface (API) server deployed on a control plane of a container-based cluster creates the secret comprising the expected external node name and the token associated with the secret, and
the secret is obtained by the network controller from the API server.
6. The method of claim 1 , wherein the network controller receives the name of the external node and the token associated with the external node from an application programming interface (API) server deployed on a control plane of a container-based cluster, wherein the control plane is also running the network controller.
7. The method of claim 1 , wherein a configuration file used to create the network agent on the external node is modified with the token.
8. A system comprising:
one or more processors; and
at least one memory, the one or more processors and the at least one memory configured to:
receive, by a network controller in a networking environment, a name of an external node where a network agent is running and a token associated with the external node;
in response to receiving the name of the external node, obtain, by the network controller, a secret associated with the token;
parse, by the network controller, the secret to determine an expected external node name corresponding to the token;
compare the expected external node name with the received external node name; and
trust the network agent when the expected external node name and the received external node name match.
9. The system of claim 8 , wherein the one or more processors and the at least one memory are further configured to:
receive, by the network controller, a request from the network agent; and
accept the request when the expected external node name and the received external node name match.
10. The system of claim 9 , wherein the one or more processors and the at least one memory are configured to receive, by the network controller, the name of the external node and the token associated with the external node with the request from the network agent.
11. The system of claim 8 , wherein:
the networking environment is divided into one or more first level isolation constructs,
each of the one or more first level isolation constructs is divided into one or more second level isolation constructs,
each of the one or more second level isolation constructs is divided into one or more virtual private clouds, and
the external node running the network agent is running in a first virtual private cloud of the one or more virtual private clouds.
12. The system of claim 11 , wherein:
an application programming interface (API) server deployed on a control plane of a container-based cluster creates the secret comprising the expected external node name and the token associated with the secret, and
the secret is obtained by the network controller from the API server.
13. The system of claim 8 , wherein the one or more processors and the at least one memory are configured to receive, by the network controller, the name of the external node and the token associated with the external node from an application programming interface (API) server deployed on a control plane of a container-based cluster, wherein the control plane is also running the network controller.
14. The system of claim 8 , wherein a configuration file used to create the network agent on the external node is modified with the token.
15. A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform operations for authenticating a network agent deployed in a networking environment, the operations comprising:
receiving, by a network controller in the networking environment, a name of an external node where the network agent is running and a token associated with the external node;
in response to receiving the name of the external node, obtaining, by the network controller, a secret associated with the token;
parsing, by the network controller, the secret to determine an expected external node name corresponding to the token;
comparing the expected external node name with the received external node name; and
trusting the network agent when the expected external node name and the received external node name match.
16. The non-transitory computer-readable medium of claim 15 , wherein the operations further comprise:
receiving, by the network controller, a request from the network agent; and
accepting the request when the expected external node name and the received external node name match.
17. The non-transitory computer-readable medium of claim 16 , wherein the network controller receives the name of the external node and the token associated with the external node with the request from the network agent.
18. The non-transitory computer-readable medium of claim 15 , wherein:
the networking environment is divided into one or more first level isolation constructs,
each of the one or more first level isolation constructs is divided into one or more second level isolation constructs,
each of the one or more second level isolation constructs is divided into one or more virtual private clouds, and
the external node running the network agent is running in a first virtual private cloud of the one or more virtual private clouds.
19. The non-transitory computer-readable medium of claim 18 , wherein:
an application programming interface (API) server deployed on a control plane of a container-based cluster creates the secret comprising the expected external node name and the token associated with the secret, and
the secret is obtained by the network controller from the API server.
20. The non-transitory computer-readable medium of claim 15 , wherein the network controller receives the name of the external node and the token associated with the external node from an application programming interface (API) server deployed on a control plane of a container-based cluster, wherein the control plane is also running the network controller.