From 90e0c43bf2737ae5b6839b7f31c5c40b1300f69b Mon Sep 17 00:00:00 2001 From: Bryan Boreham Date: Sat, 12 Oct 2019 11:08:51 +0000 Subject: [PATCH] Add a note on how to secure the Kubernetes Addon configuration. Original author Vladimir Pouzanov --- site/kubernetes/kube-addon.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/site/kubernetes/kube-addon.md b/site/kubernetes/kube-addon.md index 08be3bf3..5a80820a 100644 --- a/site/kubernetes/kube-addon.md +++ b/site/kubernetes/kube-addon.md @@ -18,6 +18,7 @@ The following topics are discussed: * [Troubleshooting Blocked Connections](#blocked-connections) * [Things to watch out for](#key-points) * [Changing Configuration Options](#configuration-options) +* [Securing The Setup](#securing-the-setup) ## Installation @@ -33,6 +34,8 @@ with a single command: $ kubectl apply -f "https://cloud.weave.works/k8s/net?k8s-version=$(kubectl version | base64 | tr -d '\n')" ``` +**Important:** this configuration won't enable encryption by default. If your data plane traffic isn't secured that could allow malicious actors to access your pod network. Read on to see the alternatives. + After a few seconds, a Weave Net pod should be running on each Node and any further pods you create will be automatically attached to the Weave network. @@ -447,3 +450,11 @@ For example, - name: IPALLOC_RANGE value: 10.0.0.0/16 ``` + +## Securing the Setup + +You must pass the `password-secret` option as noted in the previous section to enable the data plane encryption; this is a recommended option in case you cannot be sure about the security of the fabric between your nodes. + +A different option is to use `trusted-subnets` and whitelist only the subnets that host your k8s nodes. Mind that depending on your circumstances that might allow a malicious container running in your cluster to access the weave dataplane, still. + +Read on the [Securing Connections Across Untrusted Networks](/site/tasks/manage/security-untrusted-networks/) document to see the alternatives.