Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

disable injecting unnecessary variables allowing access to k8s API #1591

Merged
merged 4 commits into from
Feb 5, 2022
Merged

disable injecting unnecessary variables allowing access to k8s API #1591

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3429bc7
disable injecting unnecessary variables allowing access to k8s API
paulfantom Feb 4, 2022
731843f
manifests: regenerate
paulfantom Feb 4, 2022
8cb6979
docs: add security considerations regarding automountServiceAccountToken
paulfantom Feb 4, 2022
dd37165
*: reduce kubescale threshold to single digit
paulfantom Feb 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@ JSONNETFMT_ARGS=-n 2 --max-blank-lines 2 --string-style s --comment-style s
MDOX_VALIDATE_CONFIG?=.mdox.validate.yaml
MD_FILES_TO_FORMAT=$(shell find docs developer-workspace examples experimental jsonnet manifests -name "*.md") $(shell ls *.md)

KUBESCAPE_THRESHOLD=9

all: generate fmt test docs

.PHONY: clean
Expand Down Expand Up @@ -66,7 +68,7 @@ kubeconform: crdschemas manifests $(KUBECONFORM_BIN)

.PHONY: kubescape
kubescape: $(KUBESCAPE_BIN) ## Runs a security analysis on generated manifests - failing if risk score is above threshold percentage 't'
$(KUBESCAPE_BIN) scan -s framework -t 17 nsa manifests/*.yaml --exceptions 'kubescape-exceptions.json'
$(KUBESCAPE_BIN) scan -s framework -t $(KUBESCAPE_THRESHOLD) nsa manifests/*.yaml --exceptions 'kubescape-exceptions.json'

.PHONY: fmt
fmt: $(JSONNETFMT_BIN)
Expand Down
13 changes: 13 additions & 0 deletions docs/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,16 @@ While we aim for best practices in terms of security by default, due to the natu
* Host Port is set. https://hub.armo.cloud/docs/c-0044 is not relevant since node-exporter is considered as a core platform component running as a DaemonSet.
* Host PID is set to `true`, since node-exporter requires direct access to the host namespace to gather statistics.
* Host Network is set to `true`, since node-exporter requires direct access to the host network to gather statistics.
* `automountServiceAccountToken` is set to `true` on Pod level as kube-rbac-proxy sidecar requires connection to kubernetes API server.

#### prometheus-adapter
* `automountServiceAccountToken` is set to `true` on Pod level as application requires connection to kubernetes API server.

#### blackbox-exporter
* `automountServiceAccountToken` is set to `true` on Pod level as kube-rbac-proxy sidecar requires connection to kubernetes API server.

#### kube-state-metrics
* `automountServiceAccountToken` is set to `true` on Pod level as kube-rbac-proxy sidecars requires connection to kubernetes API server.

#### prometheus-operator
* `automountServiceAccountToken` is set to `true` on Pod level as kube-rbac-proxy sidecars requires connection to kubernetes API server.
1 change: 1 addition & 0 deletions jsonnet/kube-prometheus/components/alertmanager.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ function(params) {
apiVersion: 'v1',
kind: 'ServiceAccount',
metadata: am._metadata,
automountServiceAccountToken: false,
},

service: {
Expand Down
2 changes: 2 additions & 0 deletions jsonnet/kube-prometheus/components/blackbox-exporter.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,7 @@ function(params) {
apiVersion: 'v1',
kind: 'ServiceAccount',
metadata: bb._metadata,
automountServiceAccountToken: false,
},

clusterRole: {
Expand Down Expand Up @@ -238,6 +239,7 @@ function(params) {
spec: {
containers: [blackboxExporter, reloader, kubeRbacProxy],
nodeSelector: { 'kubernetes.io/os': 'linux' },
automountServiceAccountToken: true,
serviceAccountName: 'blackbox-exporter',
volumes: [{
name: 'config',
Expand Down
2 changes: 2 additions & 0 deletions jsonnet/kube-prometheus/components/grafana.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,10 +88,12 @@ function(params)
// 'allowPrivilegeEscalation: false' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/128 gets merged.
// 'readOnlyRootFilesystem: true' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/129 gets merged.
// 'capabilities: { drop: ['ALL'] }' can be deleted when https://github.com/brancz/kubernetes-grafana/pull/130 gets merged.
// FIXME(paulfantom): `automountServiceAccountToken` can be removed after porting to brancz/kuberentes-grafana
deployment+: {
spec+: {
template+: {
spec+: {
automountServiceAccountToken: false,
containers: std.map(function(c) c {
securityContext+: {
allowPrivilegeEscalation: false,
Expand Down
1 change: 1 addition & 0 deletions jsonnet/kube-prometheus/components/kube-state-metrics.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ function(params) (import 'github.com/kubernetes/kube-state-metrics/jsonnet/kube-
},
},
spec+: {
automountServiceAccountToken: true,
containers: std.map(function(c) c {
ports:: null,
livenessProbe:: null,
Expand Down
2 changes: 2 additions & 0 deletions jsonnet/kube-prometheus/components/node-exporter.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,6 +114,7 @@ function(params) {
apiVersion: 'v1',
kind: 'ServiceAccount',
metadata: ne._metadata,
automountServiceAccountToken: false,
},

service: {
Expand Down Expand Up @@ -240,6 +241,7 @@ function(params) {
{ name: 'sys', hostPath: { path: '/sys' } },
{ name: 'root', hostPath: { path: '/' } },
],
automountServiceAccountToken: true,
serviceAccountName: ne._config.name,
securityContext: {
runAsUser: 65534,
Expand Down
2 changes: 2 additions & 0 deletions jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,6 +253,7 @@ function(params) {
spec: {
containers: [c],
serviceAccountName: $.serviceAccount.metadata.name,
automountServiceAccountToken: true,
nodeSelector: { 'kubernetes.io/os': 'linux' },
volumes: [
{ name: 'tmpfs', emptyDir: {} },
Expand All @@ -268,6 +269,7 @@ function(params) {
apiVersion: 'v1',
kind: 'ServiceAccount',
metadata: pa._metadata,
automountServiceAccountToken: false,
},

clusterRole: {
Expand Down
1 change: 1 addition & 0 deletions jsonnet/kube-prometheus/components/prometheus-operator.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,7 @@ function(params)
spec+: {
template+: {
spec+: {
automountServiceAccountToken: true,
containers: std.map(function(c) c {
securityContext+: {
capabilities: { drop: ['ALL'] },
Expand Down
1 change: 1 addition & 0 deletions jsonnet/kube-prometheus/components/prometheus.libsonnet
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ function(params) {
apiVersion: 'v1',
kind: 'ServiceAccount',
metadata: p._metadata,
automountServiceAccountToken: false,
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This part can be treated as a breaking change for folks who are using prometheus-operator in versions that do not have change from prometheus-operator/prometheus-operator#4514. Do you think we should wait with this until we have a new operator version and then circle back?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes sounds good

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just out of curiosity, what is the next release date?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yesterday 😄

},

service: {
Expand Down
49 changes: 49 additions & 0 deletions kubescape-exceptions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,53 @@
[
{
"name": "exclude-automountServiceAccountToken-checks",
"policyType": "postureExceptionPolicy",
"actions": [
"alertOnly"
],
"resources": [
{
"designatorType": "Attributes",
"attributes": {
"kind": "DaemonSet",
"name": "node-exporter"
}
},
{
"designatorType": "Attributes",
"attributes": {
"kind": "Deployment",
"name": "blackbox-exporter"
}
},
{
"designatorType": "Attributes",
"attributes": {
"kind": "Deployment",
"name": "kube-state-metrics"
}
},
{
"designatorType": "Attributes",
"attributes": {
"kind": "Deployment",
"name": "prometheus-adapter"
}
},
{
"designatorType": "Attributes",
"attributes": {
"kind": "Deployment",
"name": "prometheus-operator"
}
}
],
"posturePolicies": [
{
"controlName": "Automatic mapping of service account"
}
]
},
{
"name": "exclude-node-exporter-host-access-checks",
"policyType": "postureExceptionPolicy",
Expand Down
1 change: 1 addition & 0 deletions manifests/alertmanager-serviceAccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
labels:
Expand Down
1 change: 1 addition & 0 deletions manifests/blackboxExporter-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ spec:
app.kubernetes.io/part-of: kube-prometheus
app.kubernetes.io/version: 0.19.0
spec:
automountServiceAccountToken: true
containers:
- args:
- --config.file=/etc/blackbox_exporter/config.yml
Expand Down
1 change: 1 addition & 0 deletions manifests/blackboxExporter-serviceAccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
labels:
Expand Down
1 change: 1 addition & 0 deletions manifests/grafana-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ spec:
app.kubernetes.io/part-of: kube-prometheus
app.kubernetes.io/version: 8.3.4
spec:
automountServiceAccountToken: false
containers:
- env: []
image: grafana/grafana:8.3.4
Expand Down
1 change: 1 addition & 0 deletions manifests/nodeExporter-daemonset.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ spec:
app.kubernetes.io/part-of: kube-prometheus
app.kubernetes.io/version: 1.3.1
spec:
automountServiceAccountToken: true
containers:
- args:
- --web.listen-address=127.0.0.1:9100
Expand Down
1 change: 1 addition & 0 deletions manifests/nodeExporter-serviceAccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
labels:
Expand Down
1 change: 1 addition & 0 deletions manifests/prometheus-serviceAccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
labels:
Expand Down
1 change: 1 addition & 0 deletions manifests/prometheusAdapter-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ spec:
app.kubernetes.io/part-of: kube-prometheus
app.kubernetes.io/version: 0.9.1
spec:
automountServiceAccountToken: true
containers:
- args:
- --cert-dir=/var/run/serving-cert
Expand Down
1 change: 1 addition & 0 deletions manifests/prometheusAdapter-serviceAccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
apiVersion: v1
automountServiceAccountToken: false
kind: ServiceAccount
metadata:
labels:
Expand Down