Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubernetes ingress-nginx controller vulnerability

armosec.io

Post reply on HN
Print view View original

1–10 of 52 posts

Re: Kubernetes ingress-nginx controller vulnerability

#3

Post by blakesterz »

"... a user who can create or update ingress objects, can use the custom snippets feature to obtain all secrets in the cluster." I'm not a Kubernetes guy, so I'm curious, how often is there a user with only those permissions? Is it common to have a user that can create/update and then doesn't already have some kind of other access to everything else? I don't know much about Kubernetes permissions.

(I also just learned that the word Kubernetes is in the default Chrome spell checker thing, which was sure helpful in writing this comment!)

Re: Kubernetes ingress-nginx controller vulnerability

#4

Post by cassianoleal »

blakesterz wrote: post #3

"... a user who can create or update ingress objects, can use the custom snippets feature to obtain all secrets in the cluster." I'm not a Kubernetes guy, so I'm curious, how often is there a user with only those permissions? Is it common to have a user that can create/update and then doesn't already have some kind of other access to everything else? I don't know much about Kubernetes permissions. (I also just learne…

A user can have many permissions in his/her own namespace without compromising the other tenants. This sounds like it would allow any user with Ingress create/update access in any namespace to compromise secrets across all namespaces.

Re: Kubernetes ingress-nginx controller vulnerability

#5

Post by tbrownaw »

jeffbee wrote: post #2

Are they for real with that curl? Normalize better security practices!

I think it's contrary to currently-recommended ops practice (clearly imperative rather than nominally declarative), but how is it bad security practice? If you don't trust the origin, it's not like saving to a temporary file first is going to help you. Unless you're suggesting that everyone should always do their own code review and then compile from source...

Re: Kubernetes ingress-nginx controller vulnerability

#6

Post by invisible »

An issue with discussion: https://github.com/kubernetes/ingress-nginx/issues/7837

The only fix so far is removing the feature.

>According to the publication, multi-tenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue.

Ouch! I guess this means lots of secret/password rotations for k8s admins coming soon. I've always wondered if there are public Kubernetes multi-tenant setups in the wild rather than just ones with admins and developer roles/namespaces.

Re: Kubernetes ingress-nginx controller vulnerability

#7

Post by doesnotexist »

jeffbee wrote: post #2

Are they for real with that curl? Normalize better security practices!

Yeah I think everyone feels icky about 'curl https://.. | sh' but to what degree is doing so any more insecure than other "normalized" software distribution practices? See also: https://twitter.com/moyix/status/1451318133021675520

Re: Kubernetes ingress-nginx controller vulnerability

#8

Post by jeffbee »

doesnotexist wrote: post #7
jeffbee wrote: post #2

Are they for real with that curl? Normalize better security practices!

Yeah I think everyone feels icky about 'curl https:// .. | sh' but to what degree is doing so any more insecure than other "normalized" software distribution practices? See also: https://twitter.com/moyix/status/1451318133021675520

You can check for this vulnerability using the existing tooling any k8s admin already has on their systems by necessity. It's always foolish to install unknown software and security professionals should never advise that.

Re: Kubernetes ingress-nginx controller vulnerability

#9

Post by deathanatos »

invisible wrote: post #6

An issue with discussion: https://github.com/kubernetes/ingress-nginx/issues/7837 The only fix so far is removing the feature. >According to the publication, multi-tenant environments where non-admin users have permissions to create Ingress objects are most affected by this issue. Ouch! I guess this means lots of secret/password rotations for k8s admins coming soon. I've always wondered if there are public Kubernetes…

What's the actual vulnerability?

The issue links to itself for "more details"…

(Also, yeah, it'd be nice if the URL of the OP had just been the Github issue. It is just as informative (or uninformative), and isn't an advertisement…)

Post reply on HN