From dev-return-1153-apmail-openwhisk-dev-archive=openwhisk.apache.org@openwhisk.apache.org Fri Sep 29 19:05:36 2017 Return-Path: X-Original-To: apmail-openwhisk-dev-archive@minotaur.apache.org Delivered-To: apmail-openwhisk-dev-archive@minotaur.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 20B6810D5D for ; Fri, 29 Sep 2017 19:05:36 +0000 (UTC) Received: (qmail 46313 invoked by uid 500); 29 Sep 2017 19:05:35 -0000 Delivered-To: apmail-openwhisk-dev-archive@openwhisk.apache.org Received: (qmail 46264 invoked by uid 500); 29 Sep 2017 19:05:35 -0000 Mailing-List: contact dev-help@openwhisk.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: dev@openwhisk.apache.org Delivered-To: mailing list dev@openwhisk.apache.org Received: (qmail 46251 invoked by uid 99); 29 Sep 2017 19:05:35 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd1-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 29 Sep 2017 19:05:35 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd1-us-west.apache.org (ASF Mail Server at spamd1-us-west.apache.org) with ESMTP id 16CA8D4ABE for ; Fri, 29 Sep 2017 19:05:35 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd1-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: 1.878 X-Spam-Level: * X-Spam-Status: No, score=1.878 tagged_above=-999 required=6.31 tests=[DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HTML_MESSAGE=2, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=disabled Authentication-Results: spamd1-us-west.apache.org (amavisd-new); dkim=pass (1024-bit key) header.d=adobe.com Received: from mx1-lw-eu.apache.org ([10.40.0.8]) by localhost (spamd1-us-west.apache.org [10.40.0.7]) (amavisd-new, port 10024) with ESMTP id idJD48NB1iTL for ; Fri, 29 Sep 2017 19:05:32 +0000 (UTC) Received: from NAM01-BY2-obe.outbound.protection.outlook.com (mail-by2nam01on0055.outbound.protection.outlook.com [104.47.34.55]) by mx1-lw-eu.apache.org (ASF Mail Server at mx1-lw-eu.apache.org) with ESMTPS id 223345FE43 for ; Fri, 29 Sep 2017 19:05:32 +0000 (UTC) Received: from CY4PR02MB2359.namprd02.prod.outlook.com (10.169.182.9) by CY4PR02MB2358.namprd02.prod.outlook.com (10.169.182.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P256) id 15.20.77.7; Fri, 29 Sep 2017 19:05:23 +0000 Received: from CY4PR02MB2359.namprd02.prod.outlook.com ([10.169.182.9]) by CY4PR02MB2359.namprd02.prod.outlook.com ([10.169.182.9]) with mapi id 15.20.0077.016; Fri, 29 Sep 2017 19:05:23 +0000 From: Dragos Dascalita Haut To: "dev@openwhisk.apache.org" Subject: Securing Action Container communication Thread-Topic: Securing Action Container communication Thread-Index: AQHTOVOhQzr3ywTlMkKBZh0shv0euw== Date: Fri, 29 Sep 2017 19:05:23 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: spf=none (sender IP is ) smtp.mailfrom=ddascal@adobe.com; x-originating-ip: [2601:646:8b00:345e:3867:4a1e:1cab:f261] x-ms-publictraffictype: Email x-microsoft-exchange-diagnostics: 1;CY4PR02MB2358;6:OuVXJiWKqVvtVS4M/HmSpC465ZcVv/Emfk3xJzAYWTh4Z4XcGGFSZ3YBnKt+oBkzWW20rKosNzE7oTUE0PS/B3CYYBZBHmorvzKcG9fZHHW2NOEbu0Mkro86OP46HM4kSwf8T1olaBy+LNoIJ+24LeuhqEtq3s/f+JtIDidiRhWJWbp1XfsWn04GnakSk/5U/OUkG6glMlskMBsstQGykwtiWint6siNG+mBFWgP+it+YjgafQCDv2LH+j6irEP5u8Fl+ulUt5cpc4MVg+0eAPdoMBF09qWrXTIgpX5PsGZvUeSbhzPnXZmXViXdDOAycatsmLuMYOewd5u9dbpLBQ==;5:78OSB/EyQULGikSRl2GlVcdtvWQfQitSeLhmuFuvVLEDO5xeiq4taBTTUQLbrE6HVQiZS3/Tl1Hs2ewqi+icxcA25gkZYCeQ67YDgrL8qUmphMgTMJmTvmqmVNgPT1B16ttNt+Flc+GHySIqk4eL8A==;24:ffpQE07cqguMoTQMXoQvnjWH9IjFbQ39Mr0Dwvtg/oRsltlEOAu9dXZluBJPGDqRBO8ukioH1egImVUWXPd5/b6NYbbo63uHUqOo03WzUEA=;7:J/oyyskdVBiyheRnavYBzvrVhNBiwJBG/4x71IF+swshwxP/pruDb+DSGNeaEOSJckDONXj+DGOwpB+r5gsmS7B3XsKfllQmkDi4iuW0+jK2TYCG13Xi0IfvYi/vTep/qkJ3sPdjVJylQE1VCnFNiOEzffXqUPrzzWbP4iy9v/OD1F9m9rBbzkGBe1X55b/ALRf7n+FR3MRO8lqjDwmdOXBylV94kIk/h/L6tllNo5c= x-ms-exchange-antispam-srfa-diagnostics: SSOS; x-ms-office365-filtering-correlation-id: af5c1ee1-c307-4395-e3fc-08d5076d09a9 x-ms-office365-filtering-ht: Tenant x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001)(2017030254152)(48565401081)(2017052603199)(201703131423075)(201703031133081)(201702281549075);SRVR:CY4PR02MB2358; x-ms-traffictypediagnostic: CY4PR02MB2358: x-exchange-antispam-report-test: UriScan:(222300048226458); x-microsoft-antispam-prvs: x-exchange-antispam-report-cfa-test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(61425038)(6040450)(2401047)(5005006)(8121501046)(10201501046)(3002001)(100000703101)(100105400095)(93006095)(93001095)(6055026)(61426038)(61427038)(6041248)(20161123562025)(20161123564025)(20161123555025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123560025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:CY4PR02MB2358;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:CY4PR02MB2358; x-forefront-prvs: 0445A82F82 x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(39860400002)(346002)(376002)(189002)(199003)(77096006)(6116002)(10090500001)(6306002)(9686003)(236005)(3280700002)(6916009)(606006)(55016002)(99286003)(3660700001)(54896002)(7736002)(101416001)(316002)(2501003)(1730700003)(8676002)(81156014)(478600001)(8936002)(25786009)(6606003)(97736004)(2906002)(189998001)(81166006)(966005)(8990500004)(102836003)(33656002)(68736007)(105586002)(106356001)(50986999)(3480700004)(6436002)(2900100001)(6506006)(74316002)(54356999)(86362001)(14454004)(5640700003)(19627405001)(7696004)(5660300001)(2351001)(53936002);DIR:OUT;SFP:1101;SCL:1;SRVR:CY4PR02MB2358;H:CY4PR02MB2359.namprd02.prod.outlook.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; received-spf: None (protection.outlook.com: adobe.com does not designate permitted sender hosts) spamdiagnosticoutput: 1:99 spamdiagnosticmetadata: NSPM Content-Type: multipart/alternative; boundary="_000_CY4PR02MB23597E4CE3AB18CCEA73FABFA47E0CY4PR02MB2359namp_" MIME-Version: 1.0 X-OriginatorOrg: adobe.com X-MS-Exchange-CrossTenant-originalarrivaltime: 29 Sep 2017 19:05:23.5251 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: fa7b1b5a-7b34-4387-94ae-d2c178decee1 X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR02MB2358 --_000_CY4PR02MB23597E4CE3AB18CCEA73FABFA47E0CY4PR02MB2359namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I'm starting this thread based on our conversations in Slack [1]. This is a sensitive aspect, at least 2 folds: 1. Container isolation. making sure action containers can't invoke other= containers directly, nor other system components directly (db, kafka, kube= api, mesos api). What are the best ways to achieve this ? 2. Protecting restricted data on transit: securing the data plane commun= ication via SSL from controller -> kafka -> invoker -> action container. D= o we want to build this into the project, or treat it optional and only doc= ument it ? Either way, it would be great to brainstorm together on what are= the best approaches. WDYT ? Let's share our thoughts here, and then create issues for the items that we= want to implement in OpenWhisk; if we want to treat some aspects optional,= we can at least open issues to document possible approaches ? Thanks, dragos [1] - https://openwhisk-team.slack.com/archives/C3TPCAQG1/p1506704400000446 --_000_CY4PR02MB23597E4CE3AB18CCEA73FABFA47E0CY4PR02MB2359namp_--