Toolforge kubernetes uses x509 certificates as the main authentication mechanism. But as of today, it cannot revoke such certs, or check a CRL, as documented in various places upstream, and in the internet:
- https://kubernetes.io/docs/concepts/security/hardening-guide/authentication-mechanisms/#x509-client-certificate-authentication
- https://github.com/kubernetes/kubernetes/issues/18982
- https://www.tremolosecurity.com/post/kubernetes-dont-use-certificates-for-authentication
We should keep this in mind when dealing with stuff like T363983: [toolforge] Investigate authentication.
Some options we could explore to mitigate the consequences of this limitation include:
- issue x509 certs with a very short lifetime, like 1 day -- this will put some additional pressure on maintain-kubeusers
- maybe we can instrument a poor-man CRL-like mechanism via Custom Admission controllers, or Kyverno -- this is unknown as of today
