Open vinayakankugoyal opened 1 month ago
/sig node /sig auth
/cc @liggitt
This was added in https://github.com/kubernetes/kubernetes/pull/123215
/cc @adrianreber /cc @mrunalp
Unfortunately I do not understand what needs to be done, sorry. If someone can point me to an example I can try to help out, but at this point I do not understand what is missing.
The code change was, if I remember it correctly, to ensure that we do not open up access to the kubelet checkpoint API endpoint for the some proxy setup. I am happy to provide a fix but I do not know where and how.
When the feature-gate ContainerCheckpoint
is enabled the ClusterRole system:kubelet-api-admin
should have verb: *
on nodes/checkpoint
.
/triage accepted @vinayakankugoyal would you like to try to fix it?
Sure will do.
What happened?
kubelet recently started expoing a new checkpoint endpoint. A user must have RBAC
nodes/checkpoint
permission to call this endpoint. I believe we missed updating thesystem:kubelet-api-admin
ClusterRole.What did you expect to happen?
I expect
system:kubelet-api-admin
to have this permission. If this is intentional please document why?How can we reproduce it (as minimally and precisely as possible)?
system:kubelet-api-admin is configured here https://github.com/kubernetes/kubernetes/blob/b3e769b72ec1eb9d5f4928259633f75d8e373cb9/plugin/pkg/auth/authorizer/rbac/bootstrappolicy/policy.go#L392
The subject access review request for checkpoint endpoint is constructed here:
https://github.com/kubernetes/kubernetes/blob/b3e769b72ec1eb9d5f4928259633f75d8e373cb9/pkg/kubelet/server/auth.go#L108
Anything else we need to know?
No response
Kubernetes version
Cloud provider
OS version
Install tools
Container runtime (CRI) and version (if applicable)
Related plugins (CNI, CSI, ...) and versions (if applicable)