From f5afd35835bbb0a54f5788e2ccb39bacfbfc8235 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Agust=C3=ADn=20Mart=C3=ADnez=20Fay=C3=B3?= Date: Thu, 2 Jul 2026 10:24:38 -0300 Subject: [PATCH 1/3] Fix k8s workload attestor Broker API config docs and remove dead code MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Agustín Martínez Fayó --- conf/agent/agent_full.conf | 29 +++++++++++++++----- doc/plugin_agent_workloadattestor_k8s.md | 10 +++++-- pkg/agent/plugin/workloadattestor/k8s/k8s.go | 19 ------------- 3 files changed, 30 insertions(+), 28 deletions(-) diff --git a/conf/agent/agent_full.conf b/conf/agent/agent_full.conf index 91ad7dfd71..de587ee91a 100644 --- a/conf/agent/agent_full.conf +++ b/conf/agent/agent_full.conf @@ -509,6 +509,14 @@ plugins { # Defaults to false. (Linux only) # verbose_container_locator_logs = false + # experimental: Experimental plugin options, subject to change or + # removal. Holds the Kubernetes API server and SPIFFE Broker API + # configuration. + # + # api_server.cache.enabled: If true, enables a controller-runtime + # Kubernetes API server cache for object-reference lookups. + # Defaults to false. + # # broker: Broker API-specific configuration used by AttestReference. # Broker API uses AttestReference, so this block is required for # all Broker API references handled by this plugin, including @@ -549,14 +557,21 @@ plugins { # - kind: User # name: spiffe://example.org/broker # - # broker { - # access_policy = "enforced" - # brokers = [ - # { - # id = "spiffe://example.org/broker" - # pod_reference_scope = "cluster" + # experimental { + # api_server { + # cache { + # enabled = false # } - # ] + # } + # broker { + # access_policy = "enforced" + # brokers = [ + # { + # id = "spiffe://example.org/broker" + # pod_reference_scope = "cluster" + # } + # ] + # } # } # sigstore: sigstore options. Enables image cosign signatures checking. diff --git a/doc/plugin_agent_workloadattestor_k8s.md b/doc/plugin_agent_workloadattestor_k8s.md index 65d028de78..0fa641b637 100644 --- a/doc/plugin_agent_workloadattestor_k8s.md +++ b/doc/plugin_agent_workloadattestor_k8s.md @@ -48,7 +48,6 @@ since [hostprocess](https://kubernetes.io/docs/tasks/configure-pod-container/cre | Configuration | Description | |-----------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `experimental.api_server.cache.enabled` | If true, enables a controller-runtime Kubernetes API server cache for object-reference lookups. Defaults to false. | | `disable_container_selectors` | If true, container selectors are not produced. This can be used to produce pod selectors when the workload pod is known but the workload container is not ready at the time of attestation. | | `kubelet_read_only_port` | The kubelet read-only port. This is mutually exclusive with `kubelet_secure_port`. | | `kubelet_secure_port` | The kubelet secure port. It defaults to `10250` unless `kubelet_read_only_port` is set. | @@ -60,11 +59,18 @@ since [hostprocess](https://kubernetes.io/docs/tasks/configure-pod-container/cre | `use_anonymous_authentication` | If true, use anonymous authentication for kubelet communication | | `node_name_env` | The environment variable used to obtain the node name. Defaults to `MY_NODE_NAME`. | | `node_name` | The name of the node. Overrides the value obtained by the environment variable specified by `node_name_env`. | -| `experimental.broker` | Experimental Broker API options for `AttestReference`. Required when this plugin handles Broker API references. See [Broker API](#broker-api). | +| `experimental` | The experimental options that are subject to change or removal (see below). | | `sigstore` | Sigstore options. Options described below. See [Sigstore options](#sigstore-options). When set, enables verification of container image signatures and attestations. | | `use_new_container_locator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true. | | `verbose_container_locator_logs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false. | +These are the current experimental configurations. + +| experimental | Description | Default | +|:---------------------------|-----------------------------------------------------------------------------------------------------------------------------------|---------| +| `api_server.cache.enabled` | If true, enables a controller-runtime Kubernetes API server cache for object-reference lookups. | false | +| `broker` | Broker API options for `AttestReference`. Required when this plugin handles Broker API references. See [Broker API](#broker-api). | | + ## Sigstore feature This feature extends the `k8s` workload attestor with the ability to validate container image signatures and attestations using the [Sigstore](https://www.sigstore.dev/) ecosystem. It is optional and only enabled when the `sigstore` block is configured. diff --git a/pkg/agent/plugin/workloadattestor/k8s/k8s.go b/pkg/agent/plugin/workloadattestor/k8s/k8s.go index f3fad559fd..995ea25bc8 100644 --- a/pkg/agent/plugin/workloadattestor/k8s/k8s.go +++ b/pkg/agent/plugin/workloadattestor/k8s/k8s.go @@ -893,9 +893,6 @@ func (p *Plugin) findPodByName(ctx context.Context, config *k8sConfig, namespace } return nil, status.Errorf(codes.Internal, "unable to get pod from Kubernetes API: %v", err) } - if err := checkPodReferenceScope(scope, config.NodeName, pod); err != nil { - return nil, err - } return pod, nil } @@ -947,25 +944,9 @@ func (p *Plugin) findPodByUID(ctx context.Context, config *k8sConfig, uid types. if pod.UID != uid { return nil, status.Errorf(codes.NotFound, "pod %s/%s has UID %s, expected %s", pod.Namespace, pod.Name, pod.UID, uid) } - if err := checkPodReferenceScope(scope, config.NodeName, pod); err != nil { - return nil, err - } return pod, nil } -func checkPodReferenceScope(scope podReferenceScope, agentNodeName string, pod *corev1.Pod) error { - if scope != podReferenceScopeAgentNode { - return nil - } - if agentNodeName == "" { - return status.Error(codes.Internal, "agent node name is not configured") - } - if pod.Spec.NodeName != agentNodeName { - return status.Error(codes.PermissionDenied, "pod is not on the agent node") - } - return nil -} - // decodePodFromKubelet rehydrates a `corev1.Pod` from the partially-parsed // JSON the kubelet pod-list path keeps in fastjson form (the cache stores // pods as `*fastjson.Value` to avoid per-request unmarshalling when no pod From 985a9f8d99aa037d9764d26e34b6f1ccfa91d672 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Agust=C3=ADn=20Mart=C3=ADnez=20Fay=C3=B3?= Date: Thu, 2 Jul 2026 10:55:11 -0300 Subject: [PATCH 2/3] Address review comments MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Agustín Martínez Fayó --- conf/agent/agent_full.conf | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/conf/agent/agent_full.conf b/conf/agent/agent_full.conf index de587ee91a..2dd5be64fc 100644 --- a/conf/agent/agent_full.conf +++ b/conf/agent/agent_full.conf @@ -513,11 +513,11 @@ plugins { # removal. Holds the Kubernetes API server and SPIFFE Broker API # configuration. # - # api_server.cache.enabled: If true, enables a controller-runtime - # Kubernetes API server cache for object-reference lookups. - # Defaults to false. + # experimental.api_server.cache.enabled: If true, enables a + # controller-runtime Kubernetes API server cache for + # object-reference lookups. Defaults to false. # - # broker: Broker API-specific configuration used by AttestReference. + # experimental.broker: Broker API-specific configuration used by AttestReference. # Broker API uses AttestReference, so this block is required for # all Broker API references handled by this plugin, including # WorkloadPIDReference and KubernetesObjectReference. Each broker From a8911ab4917c1a0feafd2c8448321b74361d6bdd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Agust=C3=ADn=20Mart=C3=ADnez=20Fay=C3=B3?= Date: Thu, 2 Jul 2026 12:29:17 -0300 Subject: [PATCH 3/3] Align experimental config table to satisfy markdownlint MD060 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Agustín Martínez Fayó --- doc/plugin_agent_workloadattestor_k8s.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/plugin_agent_workloadattestor_k8s.md b/doc/plugin_agent_workloadattestor_k8s.md index 0fa641b637..d2bb3f6d23 100644 --- a/doc/plugin_agent_workloadattestor_k8s.md +++ b/doc/plugin_agent_workloadattestor_k8s.md @@ -59,7 +59,7 @@ since [hostprocess](https://kubernetes.io/docs/tasks/configure-pod-container/cre | `use_anonymous_authentication` | If true, use anonymous authentication for kubelet communication | | `node_name_env` | The environment variable used to obtain the node name. Defaults to `MY_NODE_NAME`. | | `node_name` | The name of the node. Overrides the value obtained by the environment variable specified by `node_name_env`. | -| `experimental` | The experimental options that are subject to change or removal (see below). | +| `experimental` | The experimental options that are subject to change or removal (see below). | | `sigstore` | Sigstore options. Options described below. See [Sigstore options](#sigstore-options). When set, enables verification of container image signatures and attestations. | | `use_new_container_locator` | If true, enables the new container locator algorithm that has support for cgroups v2. Defaults to true. | | `verbose_container_locator_logs` | If true, enables verbose logging of mountinfo and cgroup information used to locate containers. Defaults to false. |