Separate Data and Control Plane

[mpstefan]

trafficstars

As a user of NGF I want the data and control planes separated So that any security vulnerability or attack that compromises the control plane or vise verse does not affect the other plane. and so that I can easily scale the number of data planes independently of the control planes in NGF in the future.

Background

As a route to efficacy and quickly understanding the Gateway API; its implementation and alignment to NGINX as a data plane, we decided on a simplified, but rigid, deployment pattern. To improve our security posture and installation flexibility the control and data planes should be separated as semi-autonomous, distributed components.

Problems

• Control plane containers and data plane containers compose into a single Kubernetes Pod.
• Control plane containers use OS signals and file system sharing to exchange data.
• Control plane and data plane are governed by the same RBAC policies as they reside in one Pod and ServiceAccount.
• Control plane and data plane must scale dependently and cannot scale on independent axis.
• Compromise of the control plane may impact customer traffic in the data plane.
• Compromise of the data plane may expose Kubernetes API server and impact the cluster and allow horizontal movement in the network.
• Kubernetes secrets and sensitive data will be shared across containers unnecessarily.
• Violation of a basic zero-trust tenet: "The data plane and control plane are logically separated." NIST SP 800-207

Acceptance Criteria

• NGINX Gateway Fabric's data and control planes exist independently on different pods within a Kubernetes deployment.
• Data plane scales automatically with each additional Gateway object present in the cluster.
• NGINX agent configuration is somehow present in Gateway API extensions
  • Does not need to be the same extension
  • User is able to configure their environment to send OTel metrics to NGINX One

Tasks

• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/1679
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2655
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2841
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2838
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2839
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2840
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2233
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2851
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2842
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2850
• [ ] #3011
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2843
• [ ] #2990
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2844
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2845
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/1443
• [ ] https://github.com/nginx/nginx-gateway-fabric/issues/3272
• [ ] #3064
• [ ] #3115
• [ ] #3065
• [ ] #3010
• [ ] #3116
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2704
• [ ] https://github.com/nginxinc/nginx-gateway-fabric/issues/2819
• [ ] #3118
• [ ] https://github.com/nginx/nginx-gateway-fabric/issues/3120

Questions for Discussion

• What needs to be included in the design? Does one already exist?
  • Deployment architecture
  • Communication channels / protocols
  • Authentication and authorization
  • Data plane registration and scaling
• Should data plane scale horizontally for one Gateway? How is can this be controlled by the user?
• How can we split the work to achieve the split?