Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

disable kubelet_authorization_mode_webhook by default #9238

Merged
merged 1 commit into from
Aug 31, 2022
Merged

disable kubelet_authorization_mode_webhook by default #9238

merged 1 commit into from
Aug 31, 2022

Conversation

cristicalin
Copy link
Contributor

What type of PR is this?

/kind bug

What this PR does / why we need it:
When setting kubelet_authorization_mode_webhook: True kubespray creates extra kubernetes roles that might give kubelets more privileges than needed, allowing a compromised kubelet to elevate its privileges to cluster admin. We should set this to false by default and not recommend setting it to true in our hardening guide.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

disable kubelet_authorization_mode_webhook by default

@k8s-ci-robot k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 31, 2022
@k8s-ci-robot k8s-ci-robot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Aug 31, 2022
floryut
floryut approved these changes Aug 31, 2022
View reviewed changes
Copy link
Member

@floryut floryut left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Aug 31, 2022
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cristicalin, floryut

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [cristicalin,floryut]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot merged commit 6db6c86 into kubernetes-sigs:master Aug 31, 2022
enneitex added a commit to enneitex/kubespray that referenced this pull request Sep 2, 2022
@enneitex
Add privileged_without_host_devices support
3a98faa 
[CI] remove opensuse Leap from molecule test blocking CI (kubernetes-sigs#9229)

Fixes for calico_datastore: etcd (kubernetes-sigs#9228)

It seems that PR kubernetes-sigs#8839 broke `calico_datastore: etcd` when it removed ipamconfig support for etcd mode.

This PR fixes some failing tasks when `calico_datastore == etcd`, but it does not restore ipamconfig support for calico in etcd mode. If someone wants to restore ipamconfig support for `calico_datastore: etcd` please submit a follow up PR for that.

kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod (kubernetes-sigs#9223)

* fix-kube-vip-strict-arp

* fix-kube-vip-strict-arp

add runc v1.1.4 (kubernetes-sigs#9230)

Fix typo.

Fix kube_ovn_hw_offload value (kubernetes-sigs#9218)

Fix cloud_init files for different distros (kubernetes-sigs#9232)

Fix abort because calicoctl.sh is not a full path (kubernetes-sigs#9217)

feat: add kubelet systemd service hardening option (kubernetes-sigs#9194)

* feat: add kubelet systemd service hardening option

* refactor: move variable name to kubelet_secure_addresses

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* docs: add diagram about kubelet_secure_addresses variable

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

make calico installation more stable (kubernetes-sigs#9227)

Signed-off-by: hang.jiang <hang.jiang@daocloud.io>

Signed-off-by: hang.jiang <hang.jiang@daocloud.io>

Update security contacts file (kubernetes-sigs#9235)

disable kubelet_authorization_mode_webhook by default (kubernetes-sigs#9238)

add-yankay-to-reviewers (kubernetes-sigs#9247)
@floryut floryut mentioned this pull request Sep 19, 2022
Closed
@MrFreezeex
Copy link
Member

MrFreezeex commented Jan 6, 2023 •
edited
Loading

Hi @cristicalin, do you have more details about that actually? I am comparing rules from the kubernetes docs (https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/) and it seems to me that those exactly maps to what kubespray gives https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes-apps/cluster_roles/templates/node-webhook-cr.yml.j2. So at least according to the Kubernetes documentation, Kubespray doesn't seems to give more privilege than needed 🤷‍♂️.

So would you have more insight on how a kubelet would escalate with those accesses and how could kubespray possibly restrain more those rules to prevent that in the webhook authz mode?

enneitex added a commit to enneitex/kubespray that referenced this pull request Jan 25, 2023
@enneitex
Add privileged_without_host_devices support
8ef4beb 
[CI] remove opensuse Leap from molecule test blocking CI (kubernetes-sigs#9229)

Fixes for calico_datastore: etcd (kubernetes-sigs#9228)

It seems that PR kubernetes-sigs#8839 broke `calico_datastore: etcd` when it removed ipamconfig support for etcd mode.

This PR fixes some failing tasks when `calico_datastore == etcd`, but it does not restore ipamconfig support for calico in etcd mode. If someone wants to restore ipamconfig support for `calico_datastore: etcd` please submit a follow up PR for that.

kube-vip shoud fail if kube_proxy_strict_arp is false in arp mod (kubernetes-sigs#9223)

* fix-kube-vip-strict-arp

* fix-kube-vip-strict-arp

add runc v1.1.4 (kubernetes-sigs#9230)

Fix typo.

Fix kube_ovn_hw_offload value (kubernetes-sigs#9218)

Fix cloud_init files for different distros (kubernetes-sigs#9232)

Fix abort because calicoctl.sh is not a full path (kubernetes-sigs#9217)

feat: add kubelet systemd service hardening option (kubernetes-sigs#9194)

* feat: add kubelet systemd service hardening option

* refactor: move variable name to kubelet_secure_addresses

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

* docs: add diagram about kubelet_secure_addresses variable

Co-authored-by: Cristian Calin <6627509+cristicalin@users.noreply.github.com>

make calico installation more stable (kubernetes-sigs#9227)

Signed-off-by: hang.jiang <hang.jiang@daocloud.io>

Signed-off-by: hang.jiang <hang.jiang@daocloud.io>

Update security contacts file (kubernetes-sigs#9235)

disable kubelet_authorization_mode_webhook by default (kubernetes-sigs#9238)

add-yankay-to-reviewers (kubernetes-sigs#9247)
nolimitkun pushed a commit to nolimitkun/kubespray that referenced this pull request Mar 19, 2023
@cristicalin @nolimitkun
disable kubelet_authorization_mode_webhook by default (kubernetes-sig…
fb974a2 
…s#9238)
LuckySB pushed a commit to southbridgeio/kubespray that referenced this pull request Jul 7, 2023
@cristicalin @LuckySB
disable kubelet_authorization_mode_webhook by default (kubernetes-sig…
6ca49a7 
…s#9238)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@floryut floryut floryut approved these changes

@holmsten holmsten Awaiting requested review from holmsten

@liupeng0518 liupeng0518 Awaiting requested review from liupeng0518

Assignees

@floryut floryut

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. lgtm "Looks good to me", indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@cristicalin @k8s-ci-robot @MrFreezeex @floryut