Skip to main content

ADR-0124: SSH only for bootstrap, operations through agents, operator and APIs

Context​

Kit addendum 20.0, 20.2 and 20.3. The Platform Manager installs and manages the platform on one machine, several servers, an existing Kubernetes cluster or several clusters spread over datacenters. Banking networks are segmented and refuse a permanent SSH access to every machine.

Decision​

  • SSH only prepares a machine (bootstrap) and recovers it (break glass approved by two people other than the requester, time bound, audited).
  • Authentication by Ed25519 key or SSH certificate signed by an approved authority. RSA only when the client's policy requires it, with an approved size and algorithms. Password and root login refused. Host key or host certificate verification is mandatory, never StrictHostKeyChecking=no. Bastion (ProxyJump) supported.
  • A dedicated bootstrap account with a sudo allowlist generated by the Manager (never NOPASSWD: ALL). Temporary access is removed at the end of the bootstrap.
  • After the bootstrap the Manager talks to agents: the Go Node Agent supervised by systemd outside Kubernetes, the replicated Cluster Agent and the Platform Operator inside Kubernetes, and the client's management APIs (AWS, Azure, GCP, IBM) with native authentication and limited permissions.
  • Agents open an outbound mTLS connection to the Management Gateway: a single use short lived enrolment token bound to the machine, then a certificate of its own (SPIFFE identity when configured). Commands are signed, time bound, protected against replay, idempotent when possible, and each one produces a verifiable receipt.
  • In an existing cluster no SSH agent runs on the nodes: Kubernetes API and operator with minimal RBAC. The Node Agent as a DaemonSet stays a diagnostics option.

Consequences​

No inbound administration port is opened on the servers. No SSH administration key is shared between clients. Private keys stay in the client's vault: PostgreSQL only keeps references.

Evidence​

  • KIT_AGENT_PLATEFORME_IA_ENTERPRISE/ADDENDUM_INFRA_HA_BACKUP_PRA.md
  • navin-manager/server/src/navin_manager/hosts
  • navin-manager/server/src/navin_manager/infrastructure
  • navin-manager/agent-go
  • navin-manager/cluster-agent
  • navin-manager/server/tests/test_infra_ssh.py
  • navin-manager/server/tests/test_infra_api.py