feat: Add agent authentication based on instance ID #336
Conversation
Each cloud has it's own unique instance identity signatures, which can be used for zero-token authentication. This change adds support for tracking by "instance_id", and automatically authenticating with Google Cloud.
Codecov Report
@@ Coverage Diff @@
## main #336 +/- ##
==========================================
+ Coverage 67.39% 67.52% +0.13%
==========================================
Files 143 145 +2
Lines 7806 7918 +112
Branches 77 77
==========================================
+ Hits 5261 5347 +86
- Misses 2008 2026 +18
- Partials 537 545 +8
Continue to review full report at Codecov.
|
| @@ -18,6 +19,8 @@ type Options struct { | |||
| Logger slog.Logger | |||
| Database database.Store | |||
| Pubsub database.Pubsub | |||
|
|
|||
| GoogleTokenValidator *idtoken.Validator | |||
There was a problem hiding this comment.
Ah, interesting - so we'll have to add token validation for all the cloud instances we support?
There was a problem hiding this comment.
seems like longer term we might want to refactor these into some common interface or something
There was a problem hiding this comment.
That sounds like a great idea @jawnsy ! @misskniss - I'm also thinking we'll need to track the work for adding additional validators for stuff we want to have in Alpha (EC2, Azure?)
There was a problem hiding this comment.
I tried to abstract it, but didn't think it was worth it. It'll make more intricate testing harder, because we want to mock the metadata server n' such.
Maybe eventually we can, but I wanted to keep the handlers in coderd.
| // This token should only be exchanged if the instance ID is valid | ||
| // for the latest history. If an instance ID is recycled by a cloud, | ||
| // we'd hate to leak access to a user's workspace. | ||
| latestHistory, err := api.Database.GetWorkspaceHistoryByWorkspaceIDWithoutAfter(r.Context(), resourceHistory.WorkspaceID) |
There was a problem hiding this comment.
Thanks for calling this out, didn't think about this case until reading through the code 👍
| func (r roundTripper) RoundTrip(req *http.Request) (*http.Response, error) { | ||
| return r(req) | ||
| } |
There was a problem hiding this comment.
Neato, nice helper function 👍
Each cloud has it's own unique instance identity signatures, which
can be used for zero-token authentication. This change adds support
for tracking by "instance_id", and automatically authenticating
with Google Cloud.