[
https://issues.apache.org/jira/browse/RANGER-5700?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Abhishek Kumar updated RANGER-5700:
-----------------------------------
Description:
Header based authentication was added in RANGER-5499.
Extend it to add support for SPIFFE-based authentication using HTTP headers,
enabling service-to-service authentication for workload service accounts in
Kubernetes-based trusted environments.
SPIFFE: [https://spiffe.io/docs/latest/spiffe-about/overview/]
In Kubernetes deployments with a service mesh (e.g., Istio), the sidecar proxy
establishes and verifies workload identity via mutual TLS and represents it as
a SPIFFE ID
({{{}spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>{}}}). Because
the mesh has already attested and verified this identity, the receiving service
only needs to read and trust the SPIFFE ID forwarded to it as an HTTP header.
The Jira tracks support in following servers: ranger-admin, ranger-pdp
was:
Header based authentication was added in RANGER-5499.
Extend it to add support for SPIFFE-based authentication using HTTP headers,
enabling service-to-service authentication for workload service accounts in
Kubernetes-based trusted environments.
SPIFFE: [https://spiffe.io/docs/latest/spiffe-about/overview/]
In Kubernetes deployments with a service mesh (e.g., Istio), the sidecar proxy
establishes and verifies workload identity via mutual TLS and represents it as
a SPIFFE ID
({{{}spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>{}}}). Because
the mesh has already attested and verified this identity, the receiving service
only needs to read and trust the SPIFFE ID forwarded to it as an HTTP header.
The Jira tracks support in following servers: ranger-admin, ranger-pdp
> Support SPIFFE-based authn via HTTP Headers
> --------------------------------------------
>
> Key: RANGER-5700
> URL: https://issues.apache.org/jira/browse/RANGER-5700
> Project: Ranger
> Issue Type: Improvement
> Components: pdp, Ranger
> Reporter: Abhishek Kumar
> Assignee: Abhishek Kumar
> Priority: Major
>
> Header based authentication was added in RANGER-5499.
> Extend it to add support for SPIFFE-based authentication using HTTP headers,
> enabling service-to-service authentication for workload service accounts in
> Kubernetes-based trusted environments.
> SPIFFE: [https://spiffe.io/docs/latest/spiffe-about/overview/]
> In Kubernetes deployments with a service mesh (e.g., Istio), the sidecar
> proxy establishes and verifies workload identity via mutual TLS and
> represents it as a SPIFFE ID
> ({{{}spiffe://<trust-domain>/ns/<namespace>/sa/<service-account>{}}}).
> Because the mesh has already attested and verified this identity, the
> receiving service only needs to read and trust the SPIFFE ID forwarded to it
> as an HTTP header.
> The Jira tracks support in following servers: ranger-admin, ranger-pdp
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
