search

SUSE / skuba

CLI tool used to simplify (or orchestrate) kubeadm-based Kubernetes cluster deployment and update
Apache License 2.0
84 stars 57 forks source link

Security hardening for kured #1237

Open saschagrunert opened 4 years ago

saschagrunert commented 4 years ago

I think we should work on security hardening for the kured DaemonSet and maybe the application itself. It runs as privileged container which seems a more general security issue from my point of view:

https://github.com/SUSE/skuba/blob/1967cc7a06fae2e59b643045f337ea2f8dab1637/internal/pkg/skuba/addons/kured.go#L158

The Weaveworks community is already aware of the issue and I would suggest:

WDYT?

flavio commented 4 years ago

I would be super happy to see us help here! :rocket:

saschagrunert commented 4 years ago

I think this would be a good opportunity for someone who wants to start contributing to upstream, especially because it’s important but not urgent. I’m happy to help with anything and leave this issue open for now. 😊

As background information, we found this issue by working on the seccomp-operator and evaluating possible applications where we could apply default profiles. Kured seems a good start and the profile could be contributed to the operator as well. This way we could simply utilize the operator later on to deploy default profiles in our products and in the wild. 😜

jenting commented 4 years ago

The kucero also have this issue.

evrardjp commented 4 years ago

I am happy to contribute there, as I already am. However, I am not sure how we can avoid that, as we need to access host though.

saschagrunert commented 4 years ago

I am happy to contribute there, as I already am. However, I am not sure how we can avoid that, as we need to access host though.

Paulo is working on a possible solution in https://github.com/weaveworks/kured/pull/172. If that’s a feasible way then we can adapt our deployment too. 🙂