hello, I'm looking at spire as a way to attestate the identity of pod workloads. But I see that mounting a hostpath volume is required for spire to work on kubernetes. This is a problem in k8s as hostpath opens the system to vulnerability and should be used only for trusted workloads (agents etc...). so we have a casse where in order to add more security on the identity of the workload we decrease the security of the system (in particular we open to workload to node attacks).
I wonder is anyone is thinking about how to fix this issue.
In istio we had a similar problem that was fixed with the introduction of a CNI plugin to execute the privileged commands (in this case mounting the host socket). Maybe a similar approach could be used here.
hello, I'm looking at spire as a way to attestate the identity of pod workloads. But I see that mounting a hostpath volume is required for spire to work on kubernetes. This is a problem in k8s as hostpath opens the system to vulnerability and should be used only for trusted workloads (agents etc...). so we have a casse where in order to add more security on the identity of the workload we decrease the security of the system (in particular we open to workload to node attacks).
I wonder is anyone is thinking about how to fix this issue.
In istio we had a similar problem that was fixed with the introduction of a CNI plugin to execute the privileged commands (in this case mounting the host socket). Maybe a similar approach could be used here.