docs: add known limitations #416
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
m1ghtym0
commented
May 2, 2024
m1ghtym0
commented
- Move to docs (one place for one information): readme: update links #359
- Some rephrasing
- @burgerdev @3u13r Please check the policy part
m1ghtym0
added
no changelog
|
katexochen
reviewed
May 2, 2024
docs/docs/known-limitations.md
Outdated
| ## Runtime Policies | ||
|
|
||
| - **Coverage**: While the enforcement of workload policies generally functions well, [there are scenarios not yet fully covered](https://github.com/microsoft/kata-containers/releases/tag/genpolicy-0.6.2-5). It's crucial to review deployments specifically for these edge cases. | ||
| - **Policy Evaluation**: The current policy evaluation mechanism on API requests isn't stateful, which means it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the [initializer](components/index.md#the-initializer) container runs *before* the workload container. This order is vital for ensuring that all traffic between pods is securely encapsulated within TLS connections. TODO: Consequences |
Co-authored-by: Paul Meyer <[email protected]>
burgerdev
reviewed
May 2, 2024
docs/docs/known-limitations.md
Outdated
| ## Runtime Policies | ||
|
|
||
| - **Coverage**: While the enforcement of workload policies generally functions well, [there are scenarios not yet fully covered](https://github.com/microsoft/kata-containers/releases/tag/genpolicy-0.6.2-5). It's crucial to review deployments specifically for these edge cases. | ||
| - **Policy Evaluation**: The current policy evaluation mechanism on API requests isn't stateful, which means it can't ensure a prescribed order of events. Consequently, there's no guaranteed enforcement that the [initializer](components/index.md#the-initializer) container runs *before* the workload container. This order is vital for ensuring that all traffic between pods is securely encapsulated within TLS connections. TODO: Consequences |
There was a problem hiding this comment.
This is not so much of an issue with the initializer, but rather with the service mesh sidecar. If the sidecar is not launched, traffic redirection does not happen and we leak plaintext.
There was a problem hiding this comment.
Is there anything else we should mention here in terms of consequences or workarounds?
There was a problem hiding this comment.
I think we should have a general warning about relying on execution order, and a specific warning about our service mesh.
Possible workarounds for the unreliable ingress path:
- Terminate TLS in the workload directly.
- Don't serve any secrets to unauthenticated clients.
- Inspect the iptables rules on startup. We could consider making this easier by dropping a canary into the TLS dir after setting up iptables.
There was a problem hiding this comment.
Thanks. I added warnings and the additional points you mentioned.
@3u13r, please add warnings accordingly when you add the service mesh stuff.
burgerdev
approved these changes
May 6, 2024
Co-authored-by: Markus Rudy <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.