Add Admission webhook to lokomotive #704

knrt10 · 2020-07-07T12:12:24Z

Add security to components and new namespace created by the user by preventing user to mount default ServiceAccount to their pods.
Add tests for components.

My findings trying to solve this issue were

Add mutating admission webhook, which patches default Service account that is created either by lokomotive components or user. It is now a part of system-component and run in lokomotive's lokomotive-system namespace and is bootstrapped by bootkube during cluster creation.

Fixes #669

Signed-off-by: knrt10 kautilya@kinvolk.io

iaguis

Thanks for the PR!

In general it looks fine to me but I know some others were a bit hesitant about adding this kind of logic to lokoctl so I'd like to hear more opinions.

I also added some comments.

pkg/components/util/install.go

test/components/patch_serviceaccount_test.go

cli/cmd/cluster-apply.go

test/components/patch_serviceaccount_test.go

knrt10 · 2020-07-08T09:11:25Z

Updated

pkg/components/util/install.go

knrt10 · 2020-07-08T10:58:03Z

Updated @iaguis. Regarding https://github.com/kinvolk/lokomotive/pull/704/files#diff-ce65c7c95a7f9d631a0a13b7ae8f1835R90. CI for openebs-operator fails unexpectedly sometimes on either Packet or AWS, so this is a fix for that. While applying locally on a cluster a problem never occurs. So to solve CI error, doing this

invidian

I think patching the manifests and also reporting those patches upstream would be simple and better.

iaguis · 2020-07-10T10:14:07Z

I think patching the manifests and also reporting those patches upstream would be simple and better.

The point of this is to have the default ServiceAccount in all namespaces we create to not get mounted automatically in pods.

Did you mean patching all the pod templates with automountServiceAccountToken=false? I think this won't work because it will break pods that define a custom service account. If you mean adding them to pods that don't declare a ServiceAccount I think we don't have any (is that right, @knrt10?).

I was thinking that a better solution might be to have a mutating admission controller that ensures default ServiceAccounts for all namespaces have automountServiceAccountToken=false. This is the approach taken by Karydia and will apply this even to namespaces created by users.

knrt10 · 2020-07-10T11:18:02Z

Yes @iaguis. Chart templates seem fine to me. And as for solution by karydia, I saw it a couple days back and wanted to try it. Let me try and implement it

knrt10 · 2020-08-19T09:41:38Z

Updated

invidian

LGTM, Thanks @knrt10 for your patience and effort.

As this is a significant change, 2nd person should have a thorough look at it before merging.

iaguis

Some small comments. Otherwise it looks pretty nice!

assets/lokomotive-kubernetes/bootkube/resources/charts/lokomotive/templates/03-deployment.yaml

cmd/admission-webhook-server/main.go

internal/admission-webhook-server/admission-webhook-server.go

assets/lokomotive-kubernetes/aws/flatcar-linux/kubernetes/cl/controller.yaml.tmpl

test/components/patch_serviceaccount_test.go

knrt10 · 2020-08-19T14:44:31Z

Updated @iaguis

iaguis

lgtm

Re requesting review

Lokomotive now has admission webhook which adds security to existing components and any new namespace created by user, by preventing Pods to automount default service account Add tests for components Fixes #669 Signed-off-by: knrt10 <kautilya@kinvolk.io>

Signed-off-by: knrt10 <kautilya@kinvolk.io>

Previously we had upgradeComponent for releases in kube-system namespace, but now after introduction for lokomotive's own webhook and namespace, this will fix and upgrade release according to their own namespaces. Signed-off-by: knrt10 <kautilya@kinvolk.io>

With this change, we are adding a feature where helm can create namespace while bootstraping. Signed-off-by: knrt10 <kautilya@kinvolk.io>

Earlier while re-applying cluster if a release did not exist, an empty map was passed as values due to which helm got null value and upgrading of release failed. Signed-off-by: knrt10 <kautilya@kinvolk.io>

knrt10 · 2020-08-19T19:23:18Z

@iaguis @invidian can you please review again. Small change was made in deployment. Tests were failing, fixed now

knrt10 · 2020-08-20T08:46:13Z

Merging this, as Mateusz already approved it before. Thank you all for your reviews.

knrt10 requested review from invidian, ipochi and surajssd as code owners July 7, 2020 12:12

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch 2 times, most recently from 1888ae5 to 85c1a11 Compare July 7, 2020 13:01

knrt10 requested review from iaguis and johananl July 7, 2020 13:29

iaguis suggested changes Jul 7, 2020

View reviewed changes

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch 6 times, most recently from 4bf8ebd to f42c175 Compare July 8, 2020 07:52

knrt10 requested a review from iaguis July 8, 2020 08:16

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch from f42c175 to 830fb3d Compare July 8, 2020 09:11

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch 2 times, most recently from 9f93c2a to 1a45671 Compare July 8, 2020 09:37

iaguis suggested changes Jul 8, 2020

View reviewed changes

pkg/components/util/install.go Outdated Show resolved Hide resolved

pkg/components/util/install.go Outdated Show resolved Hide resolved

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch from 1a45671 to 7935baf Compare July 8, 2020 10:56

knrt10 requested a review from iaguis July 8, 2020 19:24

invidian reviewed Jul 9, 2020

View reviewed changes

knrt10 marked this pull request as draft July 20, 2020 08:29

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch 3 times, most recently from 8f2cd53 to 4cd7a49 Compare July 22, 2020 09:36

knrt10 requested a review from invidian August 19, 2020 09:41

invidian previously approved these changes Aug 19, 2020

View reviewed changes

iaguis suggested changes Aug 19, 2020

View reviewed changes

knrt10 dismissed invidian’s stale review via 77aa0ea August 19, 2020 14:44

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch from 9ba63a1 to 77aa0ea Compare August 19, 2020 14:44

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch from 77aa0ea to 49c2669 Compare August 19, 2020 14:46

knrt10 requested review from iaguis and invidian August 19, 2020 14:50

iaguis previously approved these changes Aug 19, 2020

View reviewed changes

knrt10 and others added 6 commits August 20, 2020 00:51

Add mutating admission webhook

8fbdac4

Lokomotive now has admission webhook which adds security to existing components and any new namespace created by user, by preventing Pods to automount default service account Add tests for components Fixes #669 Signed-off-by: knrt10 <kautilya@kinvolk.io>

assets/: format using terraform fmt

ecf29bd

Signed-off-by: knrt10 <kautilya@kinvolk.io>

Add go code for admission webhook

7d1f0a1

Signed-off-by: knrt10 <kautilya@kinvolk.io>

Update bootkube image

41b63b0

With this change, we are adding a feature where helm can create namespace while bootstraping. Signed-off-by: knrt10 <kautilya@kinvolk.io>

Fix install values while upgrading releases

1ae44f6

Earlier while re-applying cluster if a release did not exist, an empty map was passed as values due to which helm got null value and upgrading of release failed. Signed-off-by: knrt10 <kautilya@kinvolk.io>

knrt10 dismissed iaguis’s stale review via 1ae44f6 August 19, 2020 19:21

knrt10 force-pushed the knrt10/prevent-mounting-default-sa branch from 49c2669 to 1ae44f6 Compare August 19, 2020 19:21

knrt10 requested a review from iaguis August 19, 2020 19:23

iaguis approved these changes Aug 20, 2020

View reviewed changes

surajssd approved these changes Aug 20, 2020

View reviewed changes

knrt10 merged commit 8ad1c1b into master Aug 20, 2020

knrt10 deleted the knrt10/prevent-mounting-default-sa branch August 20, 2020 08:46

invidian mentioned this pull request Aug 27, 2020

Service account admission webhook should have failurePolicy: Fail #868

Open

knrt10 mentioned this pull request Sep 10, 2020

FLUO: convert to Helm chart #935

Merged

iaguis mentioned this pull request Oct 20, 2020

Gangway gives an empty CA when outputting kubeconfig #1103

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Admission webhook to lokomotive #704

Add Admission webhook to lokomotive #704

knrt10 commented Jul 7, 2020 •

edited

Loading

iaguis left a comment

knrt10 commented Jul 8, 2020

knrt10 commented Jul 8, 2020 •

edited

Loading

invidian left a comment

iaguis commented Jul 10, 2020

knrt10 commented Jul 10, 2020

knrt10 commented Aug 19, 2020

invidian left a comment

iaguis left a comment

knrt10 commented Aug 19, 2020

iaguis left a comment

knrt10 commented Aug 19, 2020 •

edited

Loading

knrt10 commented Aug 20, 2020

Add Admission webhook to lokomotive #704

Add Admission webhook to lokomotive #704

Conversation

knrt10 commented Jul 7, 2020 • edited Loading

iaguis left a comment

Choose a reason for hiding this comment

knrt10 commented Jul 8, 2020

knrt10 commented Jul 8, 2020 • edited Loading

invidian left a comment

Choose a reason for hiding this comment

iaguis commented Jul 10, 2020

knrt10 commented Jul 10, 2020

knrt10 commented Aug 19, 2020

invidian left a comment

Choose a reason for hiding this comment

iaguis left a comment

Choose a reason for hiding this comment

knrt10 commented Aug 19, 2020

iaguis left a comment

Choose a reason for hiding this comment

knrt10 commented Aug 19, 2020 • edited Loading

knrt10 commented Aug 20, 2020

knrt10 commented Jul 7, 2020 •

edited

Loading

knrt10 commented Jul 8, 2020 •

edited

Loading

knrt10 commented Aug 19, 2020 •

edited

Loading