Pods should only be able to mount /data/project/, /data/scratch and /public (readonly). Nothing else.
Description
Description
Details
Details
Related Changes in Gerrit:
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| tools: Enable HostPathEnforcer admission controller | operations/puppet | production | +17 -6 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | yuvipanda | T111885 Initial Deployment of Kubernetes to Tool Labs | |||
| Resolved | yuvipanda | T112718 Write admission controller disabling mounting of unauthorized volumes |
Event Timeline
Comment Actions
Not sure if I agree with that. Projects can currently read other files on NFS if permissions allow, and I'm not sure if it should be different in k8s.
Comment Actions
Sure! But they still should be disallowed from mounting /etc as rw on the host, since there are otherwise ways to compromise the host machine :)
Comment Actions
I think T116504 solves this now - since you can mount host volumes as much as you want but they won't be running as root so you can't do much damage.
Comment Actions
Closed with https://phabricator.wikimedia.org/T116504 which is a more general and better solution.
Comment Actions
This is actually necessary, since the containers still run with gid 0. Even though it doesn't have special privs unlike uid 0, lots of filesystem paths are owned by gid 0 and might accidentally be writeable by these. So let's write an admission controller to provide added defense in depth.
Comment Actions
Change 288808 had a related patch set uploaded (by Yuvipanda):
tools: Enable HostPathEnforcer admission controller
Comment Actions
Change 288808 merged by Yuvipanda:
tools: Enable HostPathEnforcer admission controller