search

citizensadvice / kube-schedule-scaler

Kubernetes Controller which provides schedule scaling to Kubernetes deployments
GNU General Public License v3.0
26 stars 13 forks source link

Update pykube-ng and restrict RBAC permissions #4

Closed teqwve closed 2 years ago

teqwve commented 2 years ago

Hi!

First of all, thanks for creating this fork, it's really great how simple it is :)

This PR replaces pykube by pykube-ng (which is its maintained fork) and uses updated version to weaken RBAC permissions required by kube-schedule-scaler fixing a potential security issue. It's enough to just grant permissions to patch "deployments/scale" subresource (apparently available even in 1.18, I haven't looked on older versions) and thus allow this code only to scale deployments, not change them in an arbitrary way (replacing image, service account, mounts, etc) :)

To maintain a compatibility with previous deployments (there is 'master' tag used in example :/) I had to add some workaround, it's in the last commit.

I tested it on running 1.21 kubernetes cluster with different rbac versions. I can also test other versions with minikube. Moreover, I have a draft of e2e tests that starts different minikube versions, runs some deployments and runs kube-schedule-scaler against them. If you'd like I'd be very happy to finish them and submit here.

teqwve commented 2 years ago

Oh, and this PR has a side-effect of fixing docker builds. Apparently some dependency of pykube refuses to be built inside this docker image. With pykube-ng everything works like a charm

michelesr commented 2 years ago

@teqwve thanks for this and sorry for reviewing so late... can you please resolve the conflicts so we can merge? We added gcc and libc-dev to the Dockerfile as the latest builds didn't work without it.