Include update operation in build admission controller #6576

csrwng · 2016-01-07T19:55:46Z

It is possible to update a bc that was created with an allowed type to a type that is not allowed. This change closes that loophole.

Fixes #6556

csrwng · 2016-01-07T19:56:03Z

@bparees ptal
@jwforres fyi

bparees · 2016-01-07T21:22:09Z

test/integration/build_admission_test.go

+	for _, strategy := range buildStrategyTypes() {
+		for clientType, client := range clients {
+			if _, err := updateBuild(t, client.Builds(testutil.Namespace()), builds[string(strategy)+clientType]); !kapierror.IsForbidden(err) {
+				t.Errorf("epxected forbidden for strategy %s and client %s: got %v", strategy, clientType, err)


bparees · 2016-01-07T22:14:11Z

lgtm

openshift-bot · 2016-01-07T22:15:43Z

[Test]ing while waiting on the merge queue

deads2k · 2016-01-09T01:24:08Z

[test]

deads2k · 2016-01-11T14:25:28Z

@csrwng Not a known flake:

FAILURE after 0.168s: hack/../test/cmd/builds.sh:79: executing 'oc patch bc/ruby-sample-build -p '{"spec":{"output":{"to":{"name":"different:tag1"}}}}'' expecting success: the command returned the wrong error code
There was no output from the command.
Standard error from the command:
Error from server: resource: required value
!!! Error in hack/../test/cmd/../../hack/cmd_util.sh:195
    'return 1' exited with status 1
Call stack:
    1: hack/../test/cmd/../../hack/cmd_util.sh:195 os::cmd::expect_success(...)
    2: hack/../test/cmd/builds.sh:79 main(...)
Exiting with status 1
!!! Error in hack/test-cmd.sh:288
    '${test}' exited with status 1
Call stack:
    1: hack/test-cmd.sh:288 main(...)
Exiting with status 1
[FAIL] !!!!! Test Failed !!!!

csrwng · 2016-01-11T15:23:26Z

@deads2k thanks. Just discovered that this is a bug in the upstream API server... patch calls the admission control plugin with an empty object. If it gets permission, then proceeds to patch the stored object. So the admission control plugin never gets a chance to determine whether the patched object is valid or not. https://github.com/openshift/origin/blob/master/Godeps/_workspace/src/k8s.io/kubernetes/pkg/apiserver/resthandler.go#L399-L407

To get this PR in, I can add a check for an empty object and let it go through. However, you'll be able to use patch to change a build config to a type that you're not allowed to use.

csrwng · 2016-01-11T15:29:35Z

Opened k8s issue: kubernetes/kubernetes#19479

csrwng · 2016-01-11T15:57:00Z

Added check for an actual update @deads2k ptal

deads2k · 2016-01-11T15:59:03Z

pkg/build/admission/admission.go

+	if err != nil {
+		return false, err
+	}
+	return len(accessor.ResourceVersion()) > 0, nil


Can't I do a force update without a ResourceVersion? Name would have to be present.

ha, you're right... name is a better check

updated to use name

deads2k · 2016-01-11T16:15:13Z

Removing merge tags while I look at how hard proper admission will be. Depending on how bad it is, we may wait and apply this on top. I will update one way or the other this afternoon.

csrwng · 2016-01-11T16:52:25Z

reverted to not checking object on update - will depend on upstream fix

deads2k · 2016-01-11T18:11:43Z

Try building on top of #6608. It should make the update admission chain work how you expect.

csrwng · 2016-01-11T18:34:25Z

[test]

csrwng · 2016-01-11T18:53:50Z

[test]

csrwng · 2016-01-12T17:39:42Z

[test]

csrwng · 2016-01-13T01:14:54Z

@deads2k I added a commit to modify the bootstrap policy for the build controller sa. Because we are now checking build update operations, the build controller cannot update builds without having access to the build type virtual resources. How would migration of existing policy be handled in this case?

liggitt · 2016-01-13T02:10:50Z

Wait, why didn't the build controller already have those permissions? How was it able to create builds without them?

csrwng · 2016-01-13T13:49:59Z

@liggitt the build controller doesn't create builds, only the BuildConfig controller does. Looking at the startup code, the BuildImageChangeTriggerController gets a PrivilegedLoopbackOpenShiftClient, not a service account client.

liggitt · 2016-01-13T13:54:30Z

pkg/build/admission/admission.go

@@ -35,7 +35,7 @@ type buildByStrategy struct {
 // on policy based on the build strategy type
 func NewBuildByStrategy(client client.Interface) admission.Interface {
 	return &buildByStrategy{
-		Handler: admission.NewHandler(admission.Create),
+		Handler: admission.NewHandler(admission.Create, admission.Update),


is it odd that we're gating create and update on create permission on the subresource? I'd sort of expect create to check create, and update to check update

I had discussed this with @bparees ... I'm fine with either way. Because it is a virtual resource, separating create from update didn't seem to gain us much. You still have separate permission for create or update of the actual resource and requiring that permissions be aligned seemed overkill.

fair enough, just reads weird

maybe worth a comment in the policy, in case someone is confused

csrwng · 2016-01-13T14:38:40Z

added comment and updated test fixture

csrwng · 2016-01-13T16:43:42Z

seems like a flake [test]

deads2k · 2016-01-13T17:55:59Z

flake: #6635

deads2k · 2016-01-13T17:56:08Z

lgtm. squash and merge at will.

csrwng · 2016-01-13T18:02:11Z

[merge]

csrwng · 2016-01-13T21:52:26Z

[merge]

openshift-bot · 2016-01-13T23:30:37Z

continuous-integration/openshift-jenkins/merge SUCCESS (https://ci.openshift.redhat.com/jenkins/job/merge_pull_requests_origin/4630/) (Image: devenv-rhel7_3146)

csrwng · 2016-01-14T00:49:07Z

Failing on #6651

liggitt · 2016-01-14T04:28:32Z

[test][merge]

openshift-bot · 2016-01-14T04:31:23Z

Evaluated for origin test up to abdb4b3

openshift-bot · 2016-01-14T04:31:31Z

Evaluated for origin merge up to abdb4b3

openshift-bot · 2016-01-14T05:28:56Z

continuous-integration/openshift-jenkins/test SUCCESS (https://ci.openshift.redhat.com/jenkins/job/test_pull_requests_origin/8544/)

Merged by openshift-bot

bparees reviewed Jan 7, 2016
View reviewed changes

csrwng force-pushed the build_adm_update branch from 774ae0e to 8fef687 Compare January 7, 2016 21:47

csrwng force-pushed the build_adm_update branch from 8fef687 to b127dee Compare January 8, 2016 15:10

csrwng force-pushed the build_adm_update branch from b127dee to 2658298 Compare January 11, 2016 15:55

deads2k reviewed Jan 11, 2016
View reviewed changes

csrwng force-pushed the build_adm_update branch from 2658298 to 16acad2 Compare January 11, 2016 16:05

csrwng force-pushed the build_adm_update branch from 16acad2 to ef3bd0a Compare January 11, 2016 16:51

csrwng force-pushed the build_adm_update branch from ef3bd0a to 27cdff8 Compare January 11, 2016 18:26

csrwng force-pushed the build_adm_update branch from 27cdff8 to fab0067 Compare January 11, 2016 18:45

csrwng force-pushed the build_adm_update branch from adbb734 to fdc42c6 Compare January 13, 2016 01:11

liggitt reviewed Jan 13, 2016
View reviewed changes

csrwng force-pushed the build_adm_update branch from fdc42c6 to 8bcf43d Compare January 13, 2016 14:37

Include update operation in build admission controller

abdb4b3

csrwng force-pushed the build_adm_update branch from 8bcf43d to abdb4b3 Compare January 13, 2016 18:00

openshift-bot pushed a commit that referenced this pull request Jan 14, 2016

Merge pull request #6576 from csrwng/build_adm_update

3e46f5e

Merged by openshift-bot

openshift-bot merged commit 3e46f5e into openshift:master Jan 14, 2016

csrwng mentioned this pull request Jan 15, 2016

Do not check builds/details in build by strategy admission control #6678

Merged

csrwng deleted the build_adm_update branch January 27, 2016 14:43

liggitt mentioned this pull request Apr 6, 2016

I've found 3 vulnerabilities of kubernetes on NVD,did they solved? kubernetes/kubernetes#23860

Closed

Include update operation in build admission controller #6576

Include update operation in build admission controller #6576

Conversation

csrwng commented Jan 7, 2016

csrwng commented Jan 7, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bparees commented Jan 7, 2016

openshift-bot commented Jan 7, 2016

deads2k commented Jan 9, 2016

deads2k commented Jan 11, 2016

csrwng commented Jan 11, 2016

csrwng commented Jan 11, 2016

csrwng commented Jan 11, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

deads2k commented Jan 11, 2016

csrwng commented Jan 11, 2016

deads2k commented Jan 11, 2016

csrwng commented Jan 11, 2016

csrwng commented Jan 11, 2016

csrwng commented Jan 12, 2016

csrwng commented Jan 13, 2016

liggitt commented Jan 13, 2016

csrwng commented Jan 13, 2016

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

csrwng commented Jan 13, 2016

csrwng commented Jan 13, 2016

deads2k commented Jan 13, 2016

deads2k commented Jan 13, 2016

csrwng commented Jan 13, 2016

csrwng commented Jan 13, 2016

openshift-bot commented Jan 13, 2016

csrwng commented Jan 14, 2016

liggitt commented Jan 14, 2016

openshift-bot commented Jan 14, 2016

openshift-bot commented Jan 14, 2016

openshift-bot commented Jan 14, 2016