Skip to content

azure: Use IMDS attested metadata document for node identity#18163

Open
hakman wants to merge 1 commit intokubernetes:masterfrom
hakman:azure-instance-identity
Open

azure: Use IMDS attested metadata document for node identity#18163
hakman wants to merge 1 commit intokubernetes:masterfrom
hakman:azure-instance-identity

Conversation

@hakman
Copy link
Copy Markdown
Member

@hakman hakman commented Apr 5, 2026 •
edited
Loading

Replace the resourceID+vmID token with a PKCS7-signed attested metadata document from the Azure IMDS. The authenticator queries the attested document endpoint, and the verifier validates the PKCS7 signature chain, checks the nonce and expiration, then cross-verifies the signed vmId against the Azure API response.

flowchart TD
     A[VerifyToken] --> B{ResourceID scope valid?}
     B -- no --> X1[reject]
     B -- yes --> C[Verify PKCS7 signature + SAN]

     C --> D[Check nonce + freshness]
     D --> E{Embedded cert chain valid?}
     E -- yes --> G
     E -- no --> F{Matching issuer embedded?}
     F -- yes --> X2[reject: broken chain]
     F -- no --> F1[Fetch intermediates from Microsoft PKI]
     F1 --> F2{Chain valid now?}
     F2 -- no --> X3[reject]
     F2 -- yes --> G

     G{Attested subscriptionId matches?}
     G -- no --> X4[reject]
     G -- yes --> H[Azure API: get VM]

     H --> I{Attested vmId == API vmId?}
     I -- no --> X5[reject]
     I -- yes --> J[Return node identity ✓]
Loading

@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Apr 5, 2026

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Apr 5, 2026
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 5, 2026

/test pull-kops-e2e-azure-cni-cilium

@k8s-ci-robot k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Apr 5, 2026
@k8s-ci-robot
Copy link
Copy Markdown
Contributor

k8s-ci-robot commented Apr 5, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rifelpet for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested a review from olemarkus April 5, 2026 20:06
@k8s-ci-robot k8s-ci-robot added the area/provider/azure Issues or PRs related to azure provider label Apr 5, 2026
@k8s-ci-robot k8s-ci-robot requested a review from zetaab April 5, 2026 20:06
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 6, 2026

/test pull-kops-e2e-azure-cni-cilium

1 similar comment
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 6, 2026

/test pull-kops-e2e-azure-cni-cilium

@hakman hakman force-pushed the azure-instance-identity branch from 31832b8 to ea903e7 Compare April 7, 2026 12:28
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

@hakman hakman force-pushed the azure-instance-identity branch from ea903e7 to 8b7efcc Compare April 7, 2026 13:39
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

@hakman hakman force-pushed the azure-instance-identity branch from 8b7efcc to 6de77fe Compare April 7, 2026 13:50
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

@hakman hakman force-pushed the azure-instance-identity branch from 6de77fe to cb40b63 Compare April 7, 2026 13:55
@hakman hakman requested review from justinsb and rifelpet and removed request for olemarkus and zetaab April 7, 2026 13:58
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

@hakman hakman force-pushed the azure-instance-identity branch from cb40b63 to 04ff5b6 Compare April 7, 2026 15:54
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

@hakman hakman marked this pull request as ready for review April 7, 2026 16:29
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Apr 7, 2026
@k8s-ci-robot k8s-ci-robot requested review from olemarkus and zetaab April 7, 2026 16:29
@hakman
azure: Use IMDS attested metadata document for node identity
a21b2fc 
Replace the resourceID+vmID token with a PKCS7-signed attested metadata document from the Azure IMDS. The authenticator queries the attested document endpoint, and the verifier validates the PKCS7 signature chain, checks the nonce and expiration, then cross-verifies the signed vmId against the Azure API response.

Signed-off-by: Ciprian Hacman <ciprian@hakman.dev>
@hakman hakman force-pushed the azure-instance-identity branch from 04ff5b6 to a21b2fc Compare April 7, 2026 16:41
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

1 similar comment
@hakman
Copy link
Copy Markdown
Member Author

hakman commented Apr 7, 2026

/test pull-kops-e2e-azure-cni-cilium

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rifelpet rifelpet Awaiting requested review from rifelpet

@justinsb justinsb Awaiting requested review from justinsb

@olemarkus olemarkus Awaiting requested review from olemarkus

@zetaab zetaab Awaiting requested review from zetaab

Assignees

No one assigned

Labels

area/provider/azure Issues or PRs related to azure provider cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@hakman @k8s-ci-robot