[vSphere, UPI] I can read the ignition files from outside of the cluster without providing credentials

[jomeier]

Hi,

in my UPI vSphere setup I am able to get the ignition files for masters and workers with:

from my local PC which is NOT part of the cluster. In my opinion this shouldn't work without providing credentials.

Version: Beta4

The solution for that seems to be to install a firewall around the cluster. But this seems to be kind of a workaround.

I rshed into several pods on my cluster and tried this curl to check, if any user that can enter the terminal of a pod can curl the ignition files and maybe can read cloud provider secrets provided there. In this case I got a 'connection refused' message. A user seems not to be able to get the ignition file. But I feel uncomfortable if this works in all situations.

The ignition files shouldn't be available without protection of the REST API of the machine config daemon at all in my opinion.

Greetings,

Josef

[vrutkovs]

Related: openshift/machine-config-operator#784

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[vrutkovs]

This resulted in openshift/enhancements#443