Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

remove secret-based sa token client builder #99291

Merged
merged 1 commit into from
Feb 22, 2021
Merged

remove secret-based sa token client builder #99291

merged 1 commit into from
Feb 22, 2021

Conversation

zshihang
Copy link
Contributor

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

since TokenRequest is GAed, we don't need this client builder anymore

Does this PR introduce a user-facing change?

NONE

@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. area/cloudprovider sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Feb 22, 2021
@zshihang
Copy link
Contributor Author

/sig auth
/priority important-soon
/triage accepted
/assign @liggitt

@k8s-ci-robot k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Feb 22, 2021
@k8s-ci-robot k8s-ci-robot removed the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Feb 22, 2021
@zshihang zshihang force-pushed the master branch 3 times, most recently from 082f57d to 4ebe5cf Compare February 22, 2021 05:38
@k8s-ci-robot k8s-ci-robot added the area/dependency Issues or PRs related to dependency changes label Feb 22, 2021
@k8s-ci-robot k8s-ci-robot added area/test sig/testing Categorizes an issue or PR as relevant to SIG Testing. labels Feb 22, 2021
liggitt
liggitt reviewed Feb 22, 2021
View reviewed changes
staging/src/k8s.io/cloud-provider/options/options.go
AuthenticationClient: c.Client.AuthenticationV1(),
Namespace: metav1.NamespaceSystem,
}
c.ClientBuilder = clientbuilder.NewDynamicClientBuilder(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This means the user running the cloud controller manager needs serviceaccount/token create permissions. This is included in the system:kube-controller-manager role... is that what the cloud controller manager process is expected to be bound to?

cc @jpbetz

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I believe the KCM has these permission because its running the ServiceAccountController. The CCM is not running the ServiceAccountController, so ideally it should not have or need these elevated permissions. Ideally I think we should find a way to separate the controllers which need these elevated permissions from the KCM to minimize the surface area of privilege escalation attack.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SAController is not the reason that KCM needs serviceaccount/token create permission. some volumes related controller requires that permission, but more direct,

kubernetes/staging/src/k8s.io/cloud-provider/config/types.go

Line 55 in 186f934

UseServiceAccountCredentials bool
requires that as well, which is shared by both controllers.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The CCM is not running the ServiceAccountController, so ideally it should not have or need these elevated permissions

It makes sense for CCM to be able to request tokens specifically for the service accounts for the control loops in the CCM. That is possible to grant in a narrow way (grant "serviceaccounts/tokens" on just the resourceNames for the expected service accounts), but I couldn't find where the CCM role is defined.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was (understandably) unable to convince anyone to put the CCM SA as part of the standard bootstrap as its not a core component of K8s. So its up to each cloud provider to set this up. So for example the GCP setup can be found at https://github.com/kubernetes/cloud-provider-gcp/blob/0e9c8d0151f46b5a6c0beea7778c034c6984d5d0/cluster/addons/cloud-controller-manager/cloud-node-controller-binding.yaml#L13.

@liggitt
Copy link
Member

liggitt commented Feb 22, 2021

/lgtm
/approve
/retest

update the release note with info about the cloud-controller-manager once you get feedback from @jpbetz

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Feb 22, 2021
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, zshihang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 22, 2021
@k8s-ci-robot k8s-ci-robot merged commit 7cea81c into kubernetes:master Feb 22, 2021
@k8s-ci-robot k8s-ci-robot added this to the v1.21 milestone Feb 22, 2021
@nckturner nckturner mentioned this pull request May 10, 2021
Merged
@rfranzke rfranzke mentioned this pull request Feb 18, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@liggitt liggitt liggitt left review comments

@cheftako cheftako Awaiting requested review from cheftako

@deads2k deads2k Awaiting requested review from deads2k

Assignees

@liggitt liggitt

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/cloudprovider area/dependency Issues or PRs related to dependency changes area/test cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note-none Denotes a PR that doesn't merit a release note. sig/api-machinery Categorizes an issue or PR as relevant to SIG API Machinery. sig/apps Categorizes an issue or PR as relevant to SIG Apps. sig/auth Categorizes an issue or PR as relevant to SIG Auth. sig/cloud-provider Categorizes an issue or PR as relevant to SIG Cloud Provider. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
None yet
Milestone
v1.21
Development

Successfully merging this pull request may close these issues.
4 participants
@zshihang @liggitt @k8s-ci-robot @cheftako