Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Isolate JuiceShop Instances from each other using NetworkPolicies #40

Open
J12934 opened this issue Feb 6, 2020 · 3 comments
Open

Isolate JuiceShop Instances from each other using NetworkPolicies #40

J12934 opened this issue Feb 6, 2020 · 3 comments
Labels
enhancement New feature or request helm Improvements regarding the helm chart

Comments

@J12934
Copy link
Member

J12934 commented Feb 6, 2020

Currently a user could use RCE or SSRF vulnerabilities to connect to JuiceShop instances of other users.

This would kind of be a awesome challenge in itself 😅
Like: "Steal the challenge progress from another team"

But as we (currently 😉) don't have the possibility to add new Challenges at run time it would probably be best to prohibit any traffic coming from JuiceShop to other JuiceShop pods via k8s NetworkPolicies. Might even work to prevent any cluster internal traffic from the JuiceShop this would have to be tested to ensure that this doesn't cause troubles with the juice-balancer.

@J12934 J12934 added the enhancement New feature or request label Feb 6, 2020
@J12934 J12934 added this to the v4.0.0 milestone Sep 18, 2020
@J12934 J12934 removed this from the v4.0.0 milestone Jun 26, 2023
@jonasbg
Copy link
Contributor

jonasbg commented Sep 20, 2023

I've tried to isolate the juice-shop running container with the following NetworkPolicy
$cat helm/multi-juicer/templates/juice-shop/networkPolicy.yaml

{{- if .Values.juiceShop.networkPolicy }}
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: networkpolicy-juice-shop
spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: 'juice-shop'
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
      - podSelector:
          matchLabels:
            app.kubernetes.io/name: 'juice-balancer'
    ports:
    - port: http
  egress:
  - to:
      - podSelector:
          matchLabels:
            app.kubernetes.io/name: 'juice-balancer'
      - podSelector:
          matchLabels:
            app.kubernetes.io/name: 'progress-watchdog'
    ports:
    - port: http
  - ports:
    - port: 53
      protocol: UDP
    - port: 53
      protocol: TCP
    to:
    - namespaceSelector: {}
      podSelector:
        matchLabels:
          k8s-app: kube-dns
{{- end }}

I am missing the same for:

  • juice-balancer
  • progress-watchdog
  • cleanup-job

@J12934
Copy link
Member Author

J12934 commented Sep 21, 2023

@jonasbg awesome looks good 🙌

Do you know if the dns egress selector is valid for most k8s clusters? or are there setups where this might fail because the pods don't have the label?

podSelector:
  matchLabels:
    k8s-app: kube-dns

Never maintained network policies for open source helm charts only for specific cluster where i could be very sure about the labels :D

if we can I'd like to also add the net policies to the default helm chart. And have them disableable if somebody doesn't want them (for some reason). Some parts might not be doable (e.g. juice-balancer ingress) as it would come from different namespaces / sources depending on the way it's exposed to the outside of the cluster.

@J12934 J12934 added the helm Improvements regarding the helm chart label Sep 23, 2023
@jonasbg
Copy link
Contributor

jonasbg commented Sep 25, 2023

I'm not sure if the egress selector for DNS is valid for most k8s clusters unfortunately.
I am new to the NetworkPolicy setup, and I don't have that much experienced with it.

I think that this settings should be opt-in from a values.yaml file. Then its possible to gather some feedback on the adoption of it, and it won't brake anything currently deployed.

Suggested format on a values.yaml file:

balancer:
  networkPolicy:
    # -- Optional default value is false.
    enabled: true
...
juice-shop:
  networkPolicy:
    # -- Optional default value is false.
    enabled: true
    # -- Optional Match labels for the Juice Shop NetworkPolicy DNS egress rule.
    dnsMatchLabels:
      k8s-app: kube-dns
      k8s-app: coredns

Perhaps adding a dnsMatchLabels: for DNS queries?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request helm Improvements regarding the helm chart
Projects
None yet
Development

No branches or pull requests

2 participants