-1

Wondering if traffic between a pod's sidecar proxy and the pod's application(s) can be intercepted as it traverses the localhost network stack (perhaps using a eBPF module)?

Can a tenant guarantee the security of its traffic if it does not trust/control the nodes on which its pods are running?

Many thanks.

Edit: Is it possible to guarantee traffic security on untrusted infrastructure at all? And then, how to trust shared infrastructure?

gdew
  • 31
  • 1
  • 3

1 Answers1

0

Wondering if traffic between a pod's sidecar proxy and the pod's application(s) can be intercepted as it traverses the localhost network stack (perhaps using a eBPF module)?

Yes, inspecting and even changing packets on the local interface is doable with a eBPF TC or XDP program.

Though it should be noted that you can also inspect local traffic with a raw socket like used by tcpdump(this requires about the same privileges as eBPF).

Can a tenant guarantee the security of its traffic if it does not trust/control the nodes on which its pods are running?

This very much depends on your thread model. eBPF can only be used by users with root access or special capabilities. It is very hard if not impossible to protect against root level access since you such users can also access your applications memory.

But it is never bad practice to use solid encryption, even over localhost.

Is it possible to guarantee traffic security on untrusted infrastructure at all? And then, how to trust shared infrastructure?

You have to draw a line somewhere, the exact location is totally up to you and depends on how important your secrets are and from whom you are trying to keep them. Perhaps you can trust your infrastructure provider, but do you trust the hypervisor software? or the actual hardware?. Both of which are most likely not manufactured by your infrastructure provider.

Dylan Reimerink
  • 5,874
  • 2
  • 15
  • 21
  • Thank you. So the traffic can even be observed from the host userspace as it passed between service and proxy... hmm. The next question will be if a remote party can verify the underlying setup of the systems hosting the provided environment. I think I am probably being silly... Thank you for the clarifications! – gdew Aug 04 '22 at 05:18
  • In the case of kubernetes the localhost of a pod is typically a separate namespace, so multiple pods can't see each others traffic. But as root from the host, you can just enter a network namespace and start listening. I think most cloud providers will not provide access to underlying systems, because of safety. Even if they would, it is not uncommon to have mandatory backdoors or tapping infrastructure for government agencies to be used when warrants are issued. Gag orders are often issued together with these to avoid providers from informing their users. – Dylan Reimerink Aug 04 '22 at 09:34
  • It is quite incredible, those many layers of virtualisation and flalala... silos and clusters and machines and pods and containers and services and deployments and all that sophistication abstracted away, running on machines hidden from view. As if you were running your deployment on my laptop (with its many 9s) and as if I was logging it all. – gdew Aug 07 '22 at 03:56