Continuous integrity validation-based control plane communication in a container-orchestration system

One or more non-transitory computer-readable media storing computer-executable instructions that, when executed by one or more processors, cause the one or more processors to perform actions comprising:

• receiving, from a secondary node, a first request for a first attestation token, the first request including a first randomly generated nonce;
• based at least in part on the first randomly generated nonce, generating the first attestation token;
• providing, to the secondary node, the first attestation token;
• receiving, from the secondary node, authentication credentials based at least in part on the first attestation token being verified by a certificate authority (CA) server;
• providing, to the secondary node, a second request for a second attestation token, the second request including a second randomly generated nonce;
• receiving, from the secondary node, the second attestation token, the second attestation token being based at least in part on the second randomly generated nonce;
• providing, to the CA server, the second attestation token;
• based at least in part on the second attestation token, receiving, from the CA server, a first response, the first response indicating validation of the secondary node;
• and
• providing, to the secondary node, an authorization response.

A computer-implemented method comprising:

• providing, by a master node to a secondary node, a first attestation token, the first attestation token being based at least in part on a first randomly generated nonce;
• receiving, by the master node from the secondary node, authentication credentials based at least in part on the first attestation token being verified by a certificate authority (CA) server;
• receiving, by the master node from the secondary node, a second attestation token, the second attestation token being based at least in part on a second randomly generated nonce;
• receiving, from the CA server, a first response, the first response indicating validation of the secondary node based at least in part on the second attestation token being verified by the CA server;
• providing, by the master node to the secondary node, an authorization response;
• and
• performing, by the master node, a re-validation process of the secondary node, wherein the re-validation process comprises:
• receiving, from the secondary node, a third attestation token, the third attestation token being based at least in part on a third randomly generated nonce;
• and
• based at least in part on the third attestation token, receiving, from the CA server, a second response, the second response indicating validation of the secondary node based at least in part on the third attestation token being verified by the CA server.