#802 Secure controller by avoiding priv esc #819
Conversation
JorgeN118
requested review from
juan131,
alvneiayu,
mkmik,
agarcia-oss and
alemorcuq
as code owners
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
thanks @IoannisMatzaris We are investigating your change. I will come back asap. Álvaro |
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
| runAsUser: 1001 | ||
| runAsUser: 10001 | ||
| runAsGroup: 10001 | ||
| allowPrivilegeEscalation: false |
There was a problem hiding this comment.
You are including the allowPrivilegeEscalation in the values yaml but you must change the psp.yaml to include the logic to use the value that you are setting up in the values.yaml
| @@ -54,7 +54,9 @@ local namespace = 'kube-system'; | |||
| securityContext+: { | |||
| readOnlyRootFilesystem: true, | |||
| runAsNonRoot: true, | |||
| runAsUser: 1001, | |||
| allowPrivilegeEscalation: false, | |||
| runAsUser: 10001, | |||
There was a problem hiding this comment.
question: this 10001 user still belongs to root group?
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
Due to the lack of activity in the last 7 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
|
@JorgeN118 Did this change get merged after all? Currently trying to determine if users can safely set allowPrivilegeEscalation: false for sealed-secrets controller manifests. |
|
Any update here @agarcia-oss ?? Would be good to know if the controller.yaml can support this now. |
|
hi @R011y We requested some information and changes to the user and we didn't receive answer from them. This is not already included. Thanks a lot Álvaro |
|
BTW, if you are using the generated yaml that we are releasing, we have included: #1261. Maybe it solves your problems |
Description of the change
Benefits
Possible drawbacks
Applicable issues
Additional information