Page MenuHomePhabricator
Create Task
Maniphest T346313

toolforge: k8s-status: prevent it from accessing some information
Closed, ResolvedPublicSecurity
Actions

Description

The Toolforge k8s-status tool can expose via anon web interface some information that may be considered sensitive.

The observer role for k8s-status allows it to read pods/status, which may contain an exit message produced by the user, see reference https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#containerstateterminated-v1-core

Examples of user-triggered workloads that may allow this info leak:

  • build service pipelines
  • all other cluster pods

Related: https://wikitech.wikimedia.org/wiki/Portal:Toolforge/Admin/Maintenance#wmcs-k8s-enable-cluster-monitor

Reduce k8s-status permissions to it cannot expose this information.

Details

Risk Rating
Low
Author Affiliation
WMF Technology
Related Changes in GitLab:
TitleReferenceAuthorSource BranchDest Branch
Hide some pod informationtoolforge-repos/k8s-status!2taavitaavi/podsmain
Customize query in GitLab

Related Objects
Search...

Event Timeline

• aborrero created this task.Sep 14 2023, 9:37 AM
Restricted Application added a subscriber: • Aklapper. · View Herald TranscriptSep 14 2023, 9:38 AM
• aborrero added a parent task: T233372: Create a "novaobserver" equivalent for Toolforge Kubernetes cluster inspection.Sep 14 2023, 9:38 AM
• aborrero added projects: User-aborrero, cloud-services-team.
• aborrero added subscribers: dcaro, taavi, fnegri.
• aborrero renamed this task from toolforge: k8s-status: prevent it from exposing toolforge build service pipeline information to toolforge: k8s-status: prevent it from accessing some information.Sep 14 2023, 10:51 AM
• aborrero updated the task description. (Show Details)
• aborrero added a comment.Sep 14 2023, 10:55 AM

@taavi created this https://gitlab.wikimedia.org/toolforge-repos/k8s-status/-/merge_requests/2

• aborrero moved this task from Backlog to Radar/observer on the User-aborrero board.Sep 14 2023, 10:56 AM
sbassett moved this task from Incoming to Watching on the Security-Team board.Sep 15 2023, 3:46 PM
sbassett added projects: Vuln-Infoleak, SecTeam-Processed.
• joanna_borun triaged this task as Low priority.Sep 4 2024, 2:36 PM
• aborrero closed this task as Resolved.Sep 4 2024, 2:36 PM
• aborrero claimed this task.

resolved for now.

sbassett subscribed.Sep 4 2024, 3:02 PM
In T346313#10117663, @aborrero wrote:

resolved for now.

Anything keeping this task from being made public? I'm not seeing anything obvious...

• aborrero added a comment.Sep 5 2024, 12:29 PM
In T346313#10117833, @sbassett wrote:

Anything keeping this task from being made public? I'm not seeing anything obvious...

Not that I'm aware of. Please make it public, I don't know off hand which button to click.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".Sep 5 2024, 3:09 PM
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits