TLS Listener for Kine

[log1cb0mb]

Continuation or related to proposal here: #422

Currently Kine listener even though only tied to localhost, should enable TLS listener from "security perspective"

Current implementation of datastore could be actually be renamed and tlsConfig could be moved from clientCertificate to serverCertificate with flags changing to:

--server-cert-file value                   Certificate for etcd connection
--server-key-file value                    Key file for etcd connection

With this, --etcd-cafile argument could be set accordingly under kube-apiserver spec.

Even though not an essential requirement as kine being accessed via a unix socket where filesystem permissions can be used to restrict access however would be useful if the configurations can be controlled by user.

[prometherion]

I'm a bit concerned here, mostly because of the scope of this requirement. Kine is binding on the loopback network of the Tenant Control Plane container, which is not exposed externally.

I understand the requirement of having encrypted traffic to avoid packet inspection, but the scope of loopback binding makes it inaccessible even if I start a packet dump on the host: I try to be pragmatic here.

[log1cb0mb]

Makes sense. If not encrypted channel then how about using Unix socket instead of TCP for somewhat better performance and isolation/security?

[prometherion]

It seems kine can interact with UDS, I need to give it a try.

[prometherion]

It is implemented with #593! 🙌🏻