Skip to content

RFC: chaos engineering as a service #14

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

RFC: chaos engineering as a service #14

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f7e2a2f
docs: new rfc: chaos engineering as a service
shivanshs9 Mar 1, 2021
b6fc605
feat: add authentication support to caas
shivanshs9 May 17, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 38 additions & 1 deletion text/2021-02-26-chaos-engg-as-service.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,44 @@ This ensures easy maintainance and easy-to-change for these components.
Server support needs to be added to chaosd so it listens for authenticated
requests on some port of the host machine.

### Authentication & Authorization

#### Chaosd

Chaosd runs on physic nodes outside kubernetes cluster, so it is vulnerable to attack
from internet. To prevent misuse of chaosd, it needs to allow only authenticated
requests. The easiest and secure setup is to use SSL certificates to both encrypt
the request data and for authentication.
Comment on lines +55 to +58
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should unit them into one line

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

have some problems below

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

umm.. basically combine to one sentence??

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to one line


From the perspective of communication, the dashboard will represent the end user
and so act as a client, whereas chaosd instance would represent the server.
The client can be authenticated here by making use of
[SSL Client Authentication](https://aboutssl.org/ssl-tls-client-authentication-how-does-it-works/)
technique.

In this setup, private key of the certificate will be generated and kept with the
dashboard and public key would be stored on chaosd nodes. On any request,
chaosd would first verify the digital signatures presented by the client to
authenticate the request.
Comment on lines +66 to +69
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have a question, the private key is kept by client（dashboard），is it looks strange?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For authentication using certificates, the requesting entity must have the private key. Since dashboard will be calling http endpoints of chaosd, it'll have private key


#### Chaos Mesh

Chaos Mesh is by default authenticated using kubernetes token provided.
If needed, requests could be further protected using SSL certificates.

#### Dashboard

In dashboard, basic authentication protocol using username/password can be
implemented and the data of users can be stored in DB. To implement RBAC
(Role-based access control), **roles** can be defined to comprise of allowed
permissions for that role. User and Role and related by many-to-many relationship,
i.e. user can have many roles and a role can belong to many users.
Only the user with admin privilege can add/edit users and roles.

To allow access of a role to a particular chaos nodes (whether physic/kubernetes),
admin can permit the role to have access to nodes with particular tag,
which is set in the dashboard.

### Web Dashboard

With this new powerful dashboard, chaos-mesh will be one step closer to
Expand Down Expand Up @@ -76,4 +114,3 @@ NA

1. How to securely store auth credentials in the dashboard?
(could refer GitHub Secrets)
2. What authentication mechanism to use for chaosd on Physic node?