Add a pod security manifest fuzzer

[mtardy]

POC for #10.

The idea would be to generate a random valid manifest in order to fuzz the admission control. Not in a traditional fuzzing sense, like finding crashes and bugs in the implementation of the admission, but finding loopholes in the admission rules.

It uses google/gofuzz and custom fuzzing functions to generate a random but somehow valid v1.SecurityContext that can be injected into a pod's manifest.

This POC should be extended to support more fields, like stated in the original idea issue:

This should include pods with privileged initContainer and ephemeralContainers, as well as windows node specific security context fields.

In order to test this POC, checkout to the fuzz branch, compile with make and generate random SecurityContext with ./kdigger gen -f. You can generate multiples with something like that for example:

for _ in {0..10}; do ./kdigger gen -f -o json | jq '.spec.containers[].securityContext'; done

You can check against the API server if they are valid with:

./kdigger gen -f | kubectl apply --dry-run=server -f -

And by the way, I need to do an update on the main branch to scan the admission control with --dry-run by default.

[mtardy]

I added custom mutators on multiple fields and can now fuzz on pod, containers and initContainers securityContext fields.

EphemeralContainers cannot be specified at creation, unfortunately (which makes sense).

ephemeralContainers  <[]Object>
     List of ephemeral containers run in this pod. Ephemeral containers may be
     run in an existing pod to perform user-initiated actions such as debugging.
     This list cannot be specified when creating a pod, and it cannot be
     modified by updating the pod spec. In order to add an ephemeral container
     to an existing pod, use the pod's ephemeralcontainers subresource.

You can use the feature with:

while true; do ./kdigger gen --fuzz-pod --fuzz-init --fuzz-container | kubectl apply --dry-run=server -f -; done

It can be useful to just echo $? to see if creation was a success or not.

Or just look at an example with:

./kdigger gen --fuzz-pod --fuzz-init --fuzz-container

The custom mutators can still be improved to provide more sensible outputs but they should not generate invalid pods spec.

[mtardy]

I should have asked a chatbot...

[guedou]

Sweet!Sent from my iPhoneOn 2 Dec 2022, at 15:56, Mahé ***@***.***> wrote: I should have asked a chatbot... —Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>