Security Overview

PiVirt implements a defense-in-depth, zero-trust security model combining strict mTLS identity, OpenID Connect authentication, and fine-grained RBAC authorization.

Security Architecture

flowchart TB
    CLIENTS["External Clients<br/>(pvcli, Web UIs, APIs)"]
    OIDC["OIDC / JWT<br/>Authentication"]
    RBAC["RBAC<br/>Authorization"]
    MTLS["mTLS (PiTrust PKI)<br/>Encryption"]
    
    subgraph Services["PiVirt Services"]
        CP["Control Plane<br/>(director / agent)"]
        DP["Data Plane<br/>(pivirtd)"]
        ST["Storage<br/>(iscsiman)"]
    end

    CLIENTS --> OIDC
    OIDC --> RBAC
    RBAC --> MTLS
    MTLS --> CP
    MTLS --> DP
    MTLS --> ST

Security Layers

1. Authentication

• OIDC: External client authentication (pvcli, Web UIs)
• mTLS: Service-to-service authentication (PiTrust PKI & X.509 Certificates)
• API Keys: Service account authentication

2. Authorization

• RBAC: Role-based access control
• Namespace Isolation: Resource isolation per namespace
• Network Policies: Control network traffic between VMs

3. Encryption

• In Transit: mTLS for all inter-service communication
• At Rest: Encryption for sensitive data (secrets, certificates)
• VM Disks: Optional disk encryption (LUKS)

4. Audit & Compliance

• Audit Logging: All API operations logged
• Certificate Rotation: Automatic PiTrust Operator / CRD certificate rotation
• Secret Management: Integration with Vault, AWS Secrets Manager

Threat Model

External Threats

• DDoS: Rate limiting, network policies
• Unauthorized Access: OIDC, mTLS, RBAC
• Data Exfiltration: Encryption, network isolation

Internal Threats

• Privilege Escalation: RBAC, namespace isolation
• Lateral Movement: Network policies, service mesh
• Data Theft: Encryption at rest, audit logging

Supply Chain Threats

• Compromised Images: Image signing, verification
• Vulnerable Dependencies: Automated scanning, patching

Security Best Practices

1. Use mTLS Everywhere

# agent config
server:
  connectrpc:
    tls:
      cert_file: "/etc/pivirt-agent/tls/server.crt"
      key_file: "/etc/pivirt-agent/tls/server.key"
      ca_file: "/etc/pivirt-agent/tls/ca.crt"
      client_ca_file: "/etc/pivirt-agent/tls/ca.crt"

2. Implement Least Privilege RBAC

# RBAC policy
rules:
  - roles: ["operator"]
    resources: ["virtualmachines", "volumes"]
    verbs: ["get", "list", "create", "update"]
    # No delete permission

3. Isolate Namespaces

# Network policy
apiVersion: pivirt.pilab.hu/v1
kind: NetworkPolicy
metadata:
  name: isolate-production
  namespace: production
spec:
  podSelector: {}
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: monitoring

4. Rotate Secrets Regularly

# Rotate PiTrust certificates via operator (automatic 30 days before expiry)
# Or manually via pitrust CLI:
pitrust issue-mtls-server --name node-01.pivirt.internal --days 365

# Rotate OIDC tokens
pvcli auth refresh

5. Enable Audit Logging

# agent config
audit:
  enabled: true
  output: "stdout"
  format: "json"

Security Features

PiTrust PKI & Operator Integration

• Zero Trust: Every daemon and pod has a cryptographic X.509 identity
• Automatic Rotation: Operator auto-renews TLS Secrets 30 days before expiration
• Air-Gapped Operation: No external ACME/DNS challenge requirement

RBAC

• Roles: admin, operator, viewer, vm-owner
• Scope: Cluster, namespace, resource
• Conditions: Time-based, IP-based, attribute-based

Network Policies

• Ingress/Egress: Control traffic flow
• Namespace Isolation: Prevent cross-namespace access
• Pod-to-Pod: Fine-grained VM communication control

Audit Logging

• API Calls: All operations logged
• Authentication Events: Login, token refresh
• Configuration Changes: RBAC, network policies

Compliance

Standards

• SOC 2: Security, availability, processing integrity
• ISO 27001: Information security management
• GDPR: Data protection, privacy

Controls

• Access Control: RBAC, mTLS, OIDC
• Encryption: In transit, at rest
• Audit Trail: Complete operation logging
• Incident Response: Logging, alerting, forensics

Related

• Authentication
• TLS/mTLS
• RBAC
• PiTrust PKI & mTLS