search

Azure / application-gateway-kubernetes-ingress

This is an ingress controller that can be run on Azure Kubernetes Service (AKS) to allow an Azure Application Gateway to act as the ingress for an AKS cluster.
https://azure.github.io/application-gateway-kubernetes-ingress
MIT License
677 stars 421 forks source link

/etc/kubernetes/azure.json usage & security implications #971

Closed patpicos closed 4 months ago

patpicos commented 4 years ago

Is your feature request related to a problem? Please describe. A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

Describe the solution you'd like

I was reviewing the helm chart and noticed that the hostPath /etc/kubernetes/azure.json was mounted into the AGIC. This file contains sensitive data such as the cluster identity and secret. See https://github.com/Azure/application-gateway-kubernetes-ingress/blob/ef4765e206de581d4b7b8b796cae1fc3cc0ed99e/helm/ingress-azure/templates/deployment.yaml#L79-L82

AGIC should not require this level of elevation or access. I dug into the code based and found this PR merge https://github.com/Azure/application-gateway-kubernetes-ingress/pull/585/files that added the mount. It sounds like this was done to retrieve some environment data. A preferred approach would be to ask for the data as a helm chart input.

patpicos commented 4 years ago

Mounting the above hostPath has implications when using PodSecurityPolicies. A policy specific to AGIC needs to be developed to allow the access to the host file

cloudpea commented 4 years ago

When enabling Azure Policy for AKS this also causes non-compliance with the 'Kubernetes cluster pod hostPath volumes should only use allowed host paths' policy definition.