search

uvarc / accord

Top-level repository for tracking the ACCORD deployment.
0 stars 0 forks source link

k8s global discovery - need to quash within environments #17

Open nmagee opened 2 years ago

nmagee commented 2 years ago

k8s networking rules disallow interpod communications. This is good. But k8s service discovery (which is baked into k8s) still allows one user to see all other running pods, even if they cannot connect.

A sample is below. We need to figure out a way to unset/hide any that reference other environments - it could be considered a security vulnerability:

user@theia-python-nemagee-7nvdm:/home$ env
LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
THEIA_PYTHON_MALABI_N66B2_ENVOY_PORT=tcp://10.104.72.190:9000
ACCORD_WEB_SERVICE_PORT=tcp://10.100.161.75:80
YARN_VERSION=1.22.5
THEIA_CPP_MALABI_N46BK_SERVICE_PORT=80
ARCH=x64
THEIA_PYTHON_MALABI_N66B2_ENVOY_PORT_9000_TCP_PROTO=tcp
ACCORD_WEB_SERVICE_PORT_80_TCP=tcp://10.100.161.75:80
THEIA_PYTHON_NEMAGEE_LSDFP_PORT_80_TCP_PORT=80
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_PORT_9000_TCP_PROTO=tcp
JUPYTER_PYTHON_MALABI_ZLS9W_SERVICE_HOST=10.110.188.83
ACCORD_SERVICE_SERVICE_PORT=tcp://10.105.166.243:80
THEIA_PYTHON_MALABI_N66B2_PORT=tcp://10.103.81.202:80
HOSTNAME=theia-python-nemagee-7nvdm
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_PORT_9000_TCP_ADDR=10.104.121.56
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_PORT_9000_TCP_ADDR=10.107.106.82
ACCORD_SERVICE_SERVICE_SERVICE_HOST=10.105.166.243
THEIA_CPP_MALABI_N46BK_PORT=tcp://10.101.193.177:80
RSTUDIO_R_MALABI_N4JXB_PORT_80_TCP=tcp://10.111.206.188:80
RSTUDIO_R_MALABI_N4JXB_ENVOY_PORT_9000_TCP_PROTO=tcp
THEIA_CPP_MALABI_N46BK_ENVOY_PORT_9000_TCP=tcp://10.109.32.238:9000
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_PORT_9000_TCP_ADDR=10.109.5.42
THEIA_PYTHON_MALABI_N66B2_ENVOY_SERVICE_HOST=10.104.72.190
RSTUDIO_R_MALABI_N4JXB_ENVOY_PORT_9000_TCP_PORT=9000
JUPYTER_PYTHON_MALABI_ZLS9W_PORT=tcp://10.110.188.83:80
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_PORT=tcp://10.104.121.56:9000
RSTUDIO_R_MALABI_N4JXB_ENVOY_PORT_9000_TCP_ADDR=10.101.104.36
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_SERVICE_HOST=10.109.5.42
THEIA_CPP_MALABI_N46BK_ENVOY_PORT=tcp://10.109.32.238:9000
THEIA_PYTHON_NEMAGEE_7NVDM_PORT_80_TCP_PROTO=tcp
RSTUDIO_R_MALABI_N4JXB_ENVOY_PORT=tcp://10.101.104.36:9000
THEIA_PYTHON_MALABI_N66B2_ENVOY_SERVICE_PORT=9000
JUPYTER_PYTHON_MALABI_ZLS9W_SERVICE_PORT=80
ACCORD_WEB_SERVICE_SERVICE_HOST=10.100.161.75
USE_LOCAL_GIT=true
THEIA_PYTHON_MALABI_N66B2_ENVOY_PORT_9000_TCP=tcp://10.104.72.190:9000
THEIA_PYTHON_NEMAGEE_7NVDM_PORT_80_TCP=tcp://10.110.57.121:80
RSTUDIO_R_MALABI_N4JXB_PORT=tcp://10.111.206.188:80
ACCORD_SERVICE_SERVICE_PORT_80_TCP_ADDR=10.105.166.243
JUPYTER_PYTHON_MALABI_ZLS9W_PORT_80_TCP=tcp://10.110.188.83:80
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_SERVICE_HOST=10.107.106.82
SSH_AUTH_SOCK=/tmp/ssh-bOQz2tAgazuD/agent.7
ACCORD_WEB_SERVICE_PORT_80_TCP_PORT=80
THEIA_PYTHON_MALABI_N66B2_SERVICE_PORT=80
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_PORT_443_TCP_ADDR=10.96.0.1
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_PORT=tcp://10.107.106.82:9000
THEIA_CPP_MALABI_N46BK_SERVICE_HOST=10.101.193.177
JUPYTER_PYTHON_MALABI_ZLS9W_PORT_80_TCP_ADDR=10.110.188.83
THEIA_PYTHON_NEMAGEE_LSDFP_PORT_80_TCP=tcp://10.110.217.217:80
RSTUDIO_R_MALABI_N4JXB_PORT_80_TCP_ADDR=10.111.206.188
THEIA_PYTHON_NEMAGEE_7NVDM_SERVICE_HOST=10.110.57.121
ACCORD_SERVICE_SERVICE_PORT_80_TCP_PROTO=tcp
KUBERNETES_PORT=tcp://10.96.0.1:443
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_SERVICE_PORT=9000
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_PORT_9000_TCP_PORT=9000
THEIA_PYTHON_NEMAGEE_7NVDM_PORT=tcp://10.110.57.121:80
PWD=/home
THEIA_PYTHON_NEMAGEE_LSDFP_SERVICE_HOST=10.110.217.217
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_SERVICE_PORT=9000
THEIA_PYTHON_NEMAGEE_LSDFP_PORT=tcp://10.110.217.217:80
HOME=/home/user
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_SERVICE_HOST=10.104.121.56
RSTUDIO_R_MALABI_N4JXB_ENVOY_SERVICE_PORT=9000
THEIA_PYTHON_NEMAGEE_7NVDM_PORT_80_TCP_ADDR=10.110.57.121
RSTUDIO_R_MALABI_N4JXB_ENVOY_PORT_9000_TCP=tcp://10.101.104.36:9000
SSH_AGENT_PID=8
RSTUDIO_R_MALABI_N4JXB_SERVICE_HOST=10.111.206.188
THEIA_CPP_MALABI_N46BK_ENVOY_PORT_9000_TCP_PROTO=tcp
THEIA_PYTHON_MALABI_N66B2_ENVOY_PORT_9000_TCP_PORT=9000
THEIA_CPP_MALABI_N46BK_ENVOY_SERVICE_HOST=10.109.32.238
KUBERNETES_SERVICE_PORT_HTTPS=443
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_PORT_9000_TCP_PORT=9000
THEIA_CPP_MALABI_N46BK_PORT_80_TCP_PORT=80
KUBERNETES_PORT_443_TCP_PORT=443
http_proxy=http://figgis-s.hpc.virginia.edu:8080
THEIA_PYTHON_MALABI_N66B2_PORT_80_TCP_PROTO=tcp
JUPYTER_PYTHON_MALABI_ZLS9W_ENVOY_PORT_9000_TCP=tcp://10.104.121.56:9000
ACCORD_SERVICE_SERVICE_PORT_80_TCP=tcp://10.105.166.243:80
NODE_VERSION=12.18.3
LOCAL_GIT_DIRECTORY=/usr
THEIA_PYTHON_NEMAGEE_LSDFP_PORT_80_TCP_PROTO=tcp
RSTUDIO_R_MALABI_N4JXB_SERVICE_PORT=80
JUPYTER_PYTHON_MALABI_ZLS9W_PORT_80_TCP_PROTO=tcp
RSTUDIO_R_MALABI_N4JXB_ENVOY_SERVICE_HOST=10.101.104.36
THEIA_PYTHON_MALABI_N66B2_PORT_80_TCP_ADDR=10.103.81.202
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_PORT_9000_TCP=tcp://10.107.106.82:9000
KUBERNETES_PORT_443_TCP=tcp://10.96.0.1:443
THEIA_PYTHON_NEMAGEE_7NVDM_SERVICE_PORT=80
THEIA_CPP_MALABI_N46BK_ENVOY_PORT_9000_TCP_PORT=9000
ACCORD_WEB_SERVICE_PORT_80_TCP_ADDR=10.100.161.75
THEIA_PYTHON_MALABI_N66B2_PORT_80_TCP_PORT=80
THEIA_CPP_MALABI_N46BK_ENVOY_PORT_9000_TCP_ADDR=10.109.32.238
GIT_EXEC_PATH=/usr/libexec/git-core
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_SERVICE_PORT=9000
TERM=xterm-color
SHELL=/bin/bash
RSTUDIO_R_MALABI_N4JXB_PORT_80_TCP_PORT=80
THEIA_DEFAULT_PLUGINS=local-dir:/usr/local/theia/plugins
THEIA_PYTHON_MALABI_N66B2_ENVOY_PORT_9000_TCP_ADDR=10.104.72.190
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_PORT_9000_TCP_PORT=9000
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_PORT_9000_TCP=tcp://10.109.5.42:9000
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_PORT=tcp://10.109.5.42:9000
THEIA_PYTHON_MALABI_N66B2_SERVICE_HOST=10.103.81.202
ACCORD_SERVICE_SERVICE_PORT_80_TCP_PORT=80
ACCORD_WEB_SERVICE_PORT_80_TCP_PROTO=tcp
SHLVL=1
PYTHONPATH=/home/user/.local
ACCORD_SERVICE_SERVICE_SERVICE_PORT=80
THEIA_PYTHON_NEMAGEE_LSDFP_SERVICE_PORT=80
KUBERNETES_SERVICE_PORT=443
ACCORD_WEB_SERVICE_SERVICE_PORT=80
THEIA_PYTHON_NEMAGEE_7NVDM_PORT_80_TCP_PORT=80
THEIA_PYTHON_NEMAGEE_LSDFP_PORT_80_TCP_ADDR=10.110.217.217
THEIA_CPP_MALABI_N46BK_ENVOY_SERVICE_PORT=9000
THEIA_PYTHON_MALABI_N66B2_PORT_80_TCP=tcp://10.103.81.202:80
JUPYTER_PYTHON_MALABI_ZLS9W_PORT_80_TCP_PORT=80
THEIA_CPP_MALABI_N46BK_PORT_80_TCP_PROTO=tcp
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
THEIA_PYTHON_NEMAGEE_7NVDM_ENVOY_PORT_9000_TCP_PROTO=tcp
RSTUDIO_R_MALABI_N4JXB_PORT_80_TCP_PROTO=tcp
KUBERNETES_SERVICE_HOST=10.96.0.1
THEIA_PYTHON_NEMAGEE_LSDFP_ENVOY_PORT_9000_TCP_PROTO=tcp
ACCORD_WEB_SERVICE_SERVICE_PORT_ACCORD_WEB_PORT=80
ACCORD_SERVICE_SERVICE_SERVICE_PORT_ACCORD_SERVICE_PORT=80
THEIA_CPP_MALABI_N46BK_PORT_80_TCP=tcp://10.101.193.177:80
THEIA_CPP_MALABI_N46BK_PORT_80_TCP_ADDR=10.101.193.177
_=/usr/bin/env
rkc7h commented 2 years ago

@nmagee this issue was fixed to some major extend where only pods within same projects can see other pods details at this time. Is this still an issue to track or can this be closed.