Comments (3)
@nyrahul @adetalhouet
Dear porch maintainers:
I am Nanzi Yang, the reporter of this potential vulnerability. I understand that the proch do need the MutatingWebhookConfuguration related permission. As far as I am concerned, perhaps you can use Gatekeeper or OPA to restrict the resources that a MutatingWebhookConfiguration can listen to and modify.
Here's a basic example using Gatekeeper:
ConstraintTemplate
apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
name: mutatingwebhookrestriction
spec:
crd:
spec:
names:
kind: MutatingWebhookRestriction
targets:
- target: admission.k8s.gatekeeper.sh
rego: |
package mutatingwebhookrestriction
deny[msg] {
input.review.kind.kind == "MutatingWebhookConfiguration"
webhook := input.review.object.webhooks[_]
resource := webhook.rules[_].resources[_]
not allowed_resource(resource)
msg := sprintf("MutatingWebhookConfiguration cannot operate on resource: %v", [resource])
}
allowed_resource(resource) {
resource == "pods"
}
*** Constraint***
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: MutatingWebhookRestriction
metadata:
name: restrict-mutating-webhook
spec:
match:
kinds:
- apiGroups: [""]
kinds: ["MutatingWebhookConfiguration"]
The ConstraintTemplate defines a new constraint template MutatingWebhookRestriction with Rego logic to check resources in the MutatingWebhookConfiguration. The Constraint Applies this template to match all MutatingWebhookConfiguration resources.
This setup allows you to restrict users from creating MutatingWebhookConfiguration that operates on certain resources, for example, only allowing operations on pods. You can adjust the Rego logic to fit your specific requirements.
The example provided is just a starting point. The core idea is to use OPA or Gatekeeper to restrict which resources a MutatingWebhookConfiguration can listen to and modify. You can extend this approach based on your specific needs.
Looking forward to your reply.
Regards,
Nanzi Yang
from nephio.
/assign @nyrahul
from nephio.
In many cases, there is a practical reason to provide Create/Update permissions for mutatingwebhooks. In this case, the MutatingWebhookConfiguration
handling is needed for porch for rotating itβs certificate for TLS comms between kube-apiserver and porch-server. However, the general sense in the team is that we might have over provisioned access for other resources/verbs. We need to do a periodic assessment about excessive permissions issued to any serviceaccounts/users/resources in Nephio cluster along with the development team. Will keep you posted on the same. Many thanks for bringing this to our notice.
Will bring this up in the SIG-Automation and SIG-Security groups next week.
from nephio.
Related Issues (20)
- Remove porch code from Nephio controllers
- Add a "Porchfile" to kpt packages that stores porch-specific metadata HOT 13
- Improvement gathering on Nephio architecture
- Explicitly set the default value of porch's Repository object's spec.git.branch to "main" in the CRD definition
- Add one or two sentences to the release notes page (docs/release-notes/)
- Clarify which pages are draft in the documentation
- Convert TBDs to issues
- Automatic linting and language checks HOT 1
- Update porch kube code gen to use latest
- Use stock repo pkg in sandbox setup
- Investigate dropping privileged: true and explore alternatives
- Invesitage using rootless image for gitea and upgrading version to 1.20
- PackageReivsion deletionProposed sometimes deletes the packageRevision. HOT 1
- Upgrade 3pp components used in sandbox nephio install
- Update docs for OCP install
- Add WSL support for installing a Nephio management cluster
- porchctl rpkg propose/approve may fail due to a race condition as part of normal optimistic locking process
- Document the configuration parameters of the porch API server process
- dockermachines "regional" not starting HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nephio.