search

zalando-stups / fullstop

Audit reporting: collect violations across all AWS accounts
https://docs.stups.io/en/latest/components/fullstop.html
Apache License 2.0
40 stars 14 forks source link

UNSECURED_PUBLIC_ENDPOINT violations: Hard to track offending application on K8s #509

Open alexkops opened 7 years ago

alexkops commented 7 years ago

Expected behavior

When I see a UNSECURED_PUBLIC_ENDPOINT violation I want to see the offending applications. In terms of a Kubernetes deployment I only see the ELB with an autogenerated ID, but I would like to see the offending application id.

Step needed

From there you need to know how to resolve the application, e.g. with zkubectl get svc -o wide or by looking up the security group in the AWS console. It would be nice if this could be done in fullstop already.

Dependencies

K8s apis?

szuecs commented 7 years ago

@alexkops you can see all the calls zkubectl (kubectl) does, if you pass --v=9.

API to query to get the information from the default namespace: https:///api/v1/namespaces/default/services

harti2006 commented 7 years ago

Thanks for raising the issue. Currently Fullstop has no dedicated K8S support, but just applies its normal rule set to the AWS accounts where the clusters are hosted. We need to improve here.

harti2006 commented 6 years ago

PR #520 ignores the Kubernetes ELBs for now. We need to rework a good part of that check anyway, since it does not cover ELBv2 at the moment :-/