Harden exec requests against SSRF

[tallclair]

Enhancement Description

• One-line enhancement description (can be used as a release note): Harden exec requests against SSRF by preventing command modification through URL parameters and GET requests.
• Kubernetes Enhancement Proposal: https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1898-hardened-exec
• Primary contact (assignee): @tallclair
• Responsible SIGs: sig-node, sig-api-machinery
• Enhancement target (which target equals to which milestone):
  • Alpha release target: v1.20
  • Beta release target (x.y)
  • Stable release target (x.y)

---

Roadmap Summary:

• v1.20
  • Update PodExecOptions with pod reference
  • Update Kubelet API (protected by DeprecatedKubeletStreamingAPI)
    • Remove the kubelet's /run and UID-specific endpoints
    • Require POST request for kubelet streaming endpoints
    • Require options in request body
  • Update kube-apiserver
    • Always use POST for streaming requests to Kubelet
    • Send options in request body (but also query params)
    • Require POST with request body for non-websocket exec requests, guarded by alpha HardenedExecRequests
  • Update clients to send exec POST requests with options in the body (and also in query params)
    • go client (+kubectl?)
    • ...
  • Expand E2E test coverage - https://github.com/kubernetes/enhancements/tree/master/keps/sig-node/1898-hardened-exec#test-plan

[tallclair]

/sig node
/sig api-machinery

For motivation, see kubernetes/kubernetes#92914

[kikisdeliveryservice]

Hi @tallclair

Enhancements Lead here. Please update us once your KEP is up and please confirm that this is going to be alpha in 1.20.

Thanks!
Kirsten

[tallclair]

KEP is here: #1899, expecting reviews next week.
Planning alpha implementation in v1.20, expecting KEP reviews next week.
/milestone v1.20

[kikisdeliveryservice]

Thanks! Added to tracking sheet. Also updated description above to add the KEP PR link. 👍

[kikisdeliveryservice]

Also, as a reminder to be included in a release:

The KEP must be merged in an implementable state <-- yours is currently provisional, so don't forget to update this by enhancements freeze which is currently October 6th.
The KEP must have test plans
The KEP must have graduation criteria.