[Merged by Bors] - Lock down secret permissions, store secrets on tmpfs #37
Conversation
|
Hm, two remaining issues here:
|
|
Looks like the |
| // User: root/secret-operator | ||
| // Group: Controlled by Pod.securityContext.fsGroup, the actual application | ||
| // (when running as unprivileged user) | ||
| tokio::fs::set_permissions(target_path, Permissions::from_mode(0o750)) |
There was a problem hiding this comment.
Will this still allow the application to create derivatives like keystores etc. on the mount? Currently this is done in an init container running as root I believe, so probably should work?
Edit:
I tested it on kind and gke and it worked - actually even the main user was able to create files, as the init container chowns the directory, but that is something to be solved in the product operator not here I believe.
There was a problem hiding this comment.
Having thought about it a bit further, ideally I'd like to ban that altogether (not sure how..) and have the application store any extra files on a separate emptyDir mount.
|
As for the changelog, this PR was originally intended to be part of the 0.1 release. Now that it's not I'll add a note about it. |
|
Graceful operator restart is broken on main too, so that seems to be unrelated.. |
|
bors r+ |
## Description This should help reduce outside access, and start making an effort to avoid storing sensitive material on disk at all where viable. Fixes #15, fixes #10 ### Caveats - Existing `Pod`s mounting secret volumes will get stuck Terminating when deleted, until the Kubelet is restarted, or the folder is deleted manually (see Kubelet logs for more details) - This is a one-time migration due to how this PR changes volume cleanup - You may need to set `Pod.spec.securityContext.fsGroup` to give your pod permission to access the secrets, depending on how you drop permissions Co-authored-by: Stacky McStackface <stackable-bot@users.noreply.github.com>
|
Pull request successfully merged into main. Build succeeded: |
Description
This should help reduce outside access, and start making an effort to avoid storing sensitive material on disk at all where viable.
Fixes #15, fixes #10
Caveats
Pods mounting secret volumes will get stuck Terminating when deleted, until the Kubelet is restarted, or the folder is deleted manually (see Kubelet logs for more details)Pod.spec.securityContext.fsGroupto give your pod permission to access the secrets, depending on how you drop permissionsReview Checklist
Once the review is done, comment
bors r+(orbors merge) to merge. Further information