-
Notifications
You must be signed in to change notification settings - Fork 152
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Harden Job Pod Service Account RBAC Settings #1550
Comments
Thanks for opening this issue 👍. The team will review it shortly. If this is a bug report, make sure to include clear instructions how on to reproduce the problem with minimal reproducible examples, where possible. If this is a security report, please review our security policy as outlined in SECURITY.md. If you haven't already, please take a moment to review our project's Code of Conduct document. |
This issue is marked as stale due to inactivity. Add a new comment to reactivate it. |
@ihcsim can I work on this issue ? |
@Sagar2366 the code change for this is relatively simple, but a number of example blueprints will need to be updated. E.g., this etcd blueprint assumes that the job pod uses a service account that has permission to run Furthermore, due to its breaking change nature, it isn't something that we can roll out immediately. We will need to give the community sufficient notice before rolling out this change. Let me know if you are still interested in working on it. |
@ihcsim thank you for the inputs. |
@Sagar2366 Thanks again for your interest. @pavannd1 and I will go over how to handle this breaking change. I do think it's important that this gets fixed. Will keep you posted. Meanwhile, you can try out Kanister on your local cluster following the installation instructions here. Then follow this short tutorial to see Kanister in action. (The tutorial uses a |
Sure @ihcsim. |
To be discussed internally with downstream users. |
This issue is marked as stale due to inactivity. Add a new comment to reactivate it. |
This issue is closed due to inactivity. Feel free to reopen it, if it's still relevant. |
The job pod should be updated to use the namespace
default
service account if none is specified by the user, following the KubernetesJob
model. By default, the pod should also run withspec.automountServiceAccountToken: false
to NOT automatically mounted the service account credentials. Most job pod shouldn't need direct interaction with the Kubernetes API server. When it does, the pod should be using an ephemeral projectedServiceAccountToken
.The text was updated successfully, but these errors were encountered: