Trusted CAs list

[doriath]

Overview

I would like to propose adding machine.trustedCAs field, that would include the list of trusted root CAs, that would be used instead of machine.ca.crt.

Why?

Separating the list of trusted CAs from machine.ca.crt would allow:

• rotating machine.ca
• using separate CA used for user access
• using intermediate CA inside machine.ca (not sure if that would ever be needed though)

I believe that this separation would make the config a little bit cleaner, as the worker would not longer need to set the machine.ca with an empty key, and could just set the machine.trustedCAs field. It would make the responsibility of each field in configs a little more focused because right now machine.ca.crt is used for both trust list as well as leaf certificate generation.

Details

Rotating CA

If we had a separate machine.trustedCAs field, we could perform CA rotation in a following way:

1. Generate new CA (crt + key) and save it locally somewhere (not included in talos yet)
2. Add new CA.crt to machine.trustedCAs for all machines (that way all machines would trust both old and new CAs)
3. Once all machines are updated, change machine.ca in the control plane nodes to the new CA (crt + key)
4. Once the old certificate expires, remove it from machine.trustedCAs

Separate CA for user access

With list of trusted CAs, we could use some external CA to generate certificates for the users (humans). That way, we could just add the Root CA certificate of our company into machine.trustedCAs and use some external CA system to manage and generate per user certificates (e.g. with short, 20h TTL). Users would then log in to the external CA (e.g. using OAuth), get certificate and then they could connect to Talos.

That would avoid the need of storing the same CA in two places (both in Talos and in external CA system used to grant access for users).

Intermediate CA

We could use intermediate CA in the following way:

1. Generate Root CA (crt+key) manually
2. Generate Intermediate CA (crt+key) based on Root CA
3. Add Root CA (crt) into machine.trustedCAs
4. Set machine.ca to Intermediate CA (crt+key)

If Intermediate CA is compromised for some reason, in theory we could:

• revoke the Intermediate CA
• generate new Intermediate CA and set it on all control plane nodes

This means we would not need to change the machine.trustedCAs in worker nodes, and only update to control plane nodes would be required.

For this to work though, we would have to ensure that:

• intermediate CAs actually work (I am not sure if we would have to add somewhere the whole "chain" of CAs or if it would just work out of the box)
• revocation list is taken into account
• workers would automatically request a new certificate if their certificate is revoked

[smira]

yes, this is what we would like to do (it's on our radar) for both Kubernetes and Talos:

• an issuing CA
• a list of accepted CAs

I like the idea of adding additional accepted CAs which might be managed outside of the Talos cluster