From 3253739505f24b8497109421e3076672e68d2cd2 Mon Sep 17 00:00:00 2001 From: CJ Cullen Date: Wed, 24 Feb 2016 00:06:24 -0800 Subject: [PATCH] Use ABAC authz instead of AllowAll. --- cluster/gce/configure-vm.sh | 11 --------- cluster/gce/util.sh | 4 +++- .../kube-apiserver/abac-authz-policy.jsonl | 6 +++++ cluster/saltbase/salt/kube-apiserver/init.sls | 13 ++++++---- .../kube-apiserver/kube-apiserver.manifest | 24 +++++++++---------- hack/verify-flags/exceptions.txt | 2 +- 6 files changed, 29 insertions(+), 31 deletions(-) create mode 100644 cluster/saltbase/salt/kube-apiserver/abac-authz-policy.jsonl diff --git a/cluster/gce/configure-vm.sh b/cluster/gce/configure-vm.sh index 4b178e3eb96..44d8c908c3a 100755 --- a/cluster/gce/configure-vm.sh +++ b/cluster/gce/configure-vm.sh @@ -579,17 +579,6 @@ function create-salt-master-auth() { echo "${KUBE_BEARER_TOKEN},admin,admin" > "${KNOWN_TOKENS_FILE}"; echo "${KUBELET_TOKEN},kubelet,kubelet" >> "${KNOWN_TOKENS_FILE}"; echo "${KUBE_PROXY_TOKEN},kube_proxy,kube_proxy" >> "${KNOWN_TOKENS_FILE}") - - # Generate tokens for other "service accounts". Append to known_tokens. - # - # NB: If this list ever changes, this script actually has to - # change to detect the existence of this file, kill any deleted - # old tokens and add any new tokens (to handle the upgrade case). - local -r service_accounts=("system:scheduler" "system:controller_manager" "system:logging" "system:monitoring") - for account in "${service_accounts[@]}"; do - token=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null) - echo "${token},${account},${account}" >> "${KNOWN_TOKENS_FILE}" - done fi } diff --git a/cluster/gce/util.sh b/cluster/gce/util.sh index 345a657ec1f..ea624e8cfe5 100755 --- a/cluster/gce/util.sh +++ b/cluster/gce/util.sh @@ -1360,7 +1360,9 @@ function prepare-e2e() { detect-project } -# Writes configure-vm.sh to a temporary location with comments stripped. +# Writes configure-vm.sh to a temporary location with comments stripped. GCE +# limits the size of metadata fields to 32K, and stripping comments is the +# easiest way to buy us a little more room. function prepare-startup-script() { sed '/^\s*#\([^!].*\)*$/ d' ${KUBE_ROOT}/cluster/gce/configure-vm.sh > ${KUBE_TEMP}/configure-vm.sh } diff --git a/cluster/saltbase/salt/kube-apiserver/abac-authz-policy.jsonl b/cluster/saltbase/salt/kube-apiserver/abac-authz-policy.jsonl new file mode 100644 index 00000000000..53e86fd487e --- /dev/null +++ b/cluster/saltbase/salt/kube-apiserver/abac-authz-policy.jsonl @@ -0,0 +1,6 @@ +{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"admin", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} +{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubelet", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} +{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kube_proxy", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} +{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"kubecfg", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} +{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"user":"client", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} +{"apiVersion": "abac.authorization.kubernetes.io/v1beta1", "kind": "Policy", "spec": {"group":"system:serviceaccounts", "namespace": "*", "resource": "*", "apiGroup": "*", "nonResourcePath": "*"}} \ No newline at end of file diff --git a/cluster/saltbase/salt/kube-apiserver/init.sls b/cluster/saltbase/salt/kube-apiserver/init.sls index 92a52084160..fff84648877 100644 --- a/cluster/saltbase/salt/kube-apiserver/init.sls +++ b/cluster/saltbase/salt/kube-apiserver/init.sls @@ -1,5 +1,4 @@ -{% if grains.cloud is defined %} -{% if grains.cloud in ['aws', 'gce', 'vagrant', 'vsphere', 'photon-controller'] %} +{% if grains['cloud'] is defined and grains.cloud in ['aws', 'gce', 'vagrant', 'vsphere'] %} # TODO: generate and distribute tokens on other cloud providers. /srv/kubernetes/known_tokens.csv: file.managed: @@ -9,16 +8,20 @@ - mode: 600 # - watch_in: # - service: kube-apiserver -{% endif %} -{% endif %} -{% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce', 'vagrant' ,'vsphere', 'photon-controller'] %} /srv/kubernetes/basic_auth.csv: file.managed: - source: salt://kube-apiserver/basic_auth.csv - user: root - group: root - mode: 600 + +/srv/kubernetes/abac-authz-policy.jsonl: + file.managed: + - source: salt://kube-apiserver/abac-authz-policy.jsonl + - user: root + - group: root + - mode: 600 {% endif %} /var/log/kube-apiserver.log: diff --git a/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest b/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest index 051ec98ed41..a8ac7239e38 100644 --- a/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest +++ b/cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest @@ -63,22 +63,20 @@ {% set client_ca_file = "--client-ca-file=/srv/kubernetes/ca.crt" -%} {% endif -%} -{% set token_auth_file = "--token-auth-file=/dev/null" -%} -{% set basic_auth_file = "" -%} - {% set min_request_timeout = "" -%} {% if grains.minRequestTimeout is defined -%} {% set min_request_timeout = "--min-request-timeout=" + grains.minRequestTimeout -%} {% endif -%} -{% if grains.cloud is defined -%} -{% if grains.cloud in [ 'aws', 'gce', 'vagrant', 'vsphere', 'photon-controller' ] -%} - {% set token_auth_file = "--token-auth-file=/srv/kubernetes/known_tokens.csv" -%} -{% endif -%} -{% endif -%} - -{% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce', 'vagrant', 'vsphere', 'photon-controller' ] %} - {% set basic_auth_file = "--basic-auth-file=/srv/kubernetes/basic_auth.csv" -%} +{% set token_auth_file = " --token-auth-file=/dev/null" -%} +{% set basic_auth_file = "" -%} +{% set authz_mode = "" -%} +{% set abac_policy_file = "" -%} +{% if grains['cloud'] is defined and grains.cloud in [ 'aws', 'gce', 'vagrant', 'vsphere'] %} + {% set token_auth_file = " --token-auth-file=/srv/kubernetes/known_tokens.csv" -%} + {% set basic_auth_file = " --basic-auth-file=/srv/kubernetes/basic_auth.csv" -%} + {% set authz_mode = " --authorization-mode=ABAC" -%} + {% set abac_policy_file = " --authorization-policy-file=/srv/kubernetes/abac-authz-policy.jsonl" -%} {% endif -%} {% set admission_control = "" -%} @@ -96,8 +94,8 @@ {% set log_level = pillar['api_server_test_log_level'] -%} {% endif -%} -{% set params = address + " " + etcd_servers + " " + etcd_servers_overrides + " " + cloud_provider + " " + cloud_config + " " + runtime_config + " " + admission_control + " " + service_cluster_ip_range + " " + client_ca_file + " " + basic_auth_file + " " + min_request_timeout -%} -{% set params = params + " " + cert_file + " " + key_file + " --secure-port=" + secure_port + " " + token_auth_file + " " + bind_address + " " + log_level + " " + advertise_address + " " + proxy_ssh_options -%} +{% set params = address + " " + etcd_servers + " " + etcd_servers_overrides + " " + cloud_provider + " " + cloud_config + " " + runtime_config + " " + admission_control + " " + service_cluster_ip_range + " " + client_ca_file + basic_auth_file + " " + min_request_timeout -%} +{% set params = params + " " + cert_file + " " + key_file + " --secure-port=" + secure_port + token_auth_file + " " + bind_address + " " + log_level + " " + advertise_address + " " + proxy_ssh_options + authz_mode + abac_policy_file -%} # test_args has to be kept at the end, so they'll overwrite any prior configuration {% if pillar['apiserver_test_args'] is defined -%} diff --git a/hack/verify-flags/exceptions.txt b/hack/verify-flags/exceptions.txt index 33dfa1f8672..a6d5a48813b 100644 --- a/hack/verify-flags/exceptions.txt +++ b/hack/verify-flags/exceptions.txt @@ -33,7 +33,7 @@ cluster/photon-controller/util.sh: node_name=${1} cluster/rackspace/util.sh: local node_ip=$(nova show --minimal ${NODE_NAMES[$i]} \ cluster/saltbase/salt/kube-addons/kube-addons.sh:# Create admission_control objects if defined before any other addon services. If the limits cluster/saltbase/salt/kube-admission-controls/init.sls:{% if 'LimitRanger' in pillar.get('admission_control', '') %} -cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:{% set params = address + " " + etcd_servers + " " + etcd_servers_overrides + " " + cloud_provider + " " + cloud_config + " " + runtime_config + " " + admission_control + " " + service_cluster_ip_range + " " + client_ca_file + " " + basic_auth_file + " " + min_request_timeout -%} +cluster/saltbase/salt/kube-apiserver/kube-apiserver.manifest:{% set params = address + " " + etcd_servers + " " + etcd_servers_overrides + " " + cloud_provider + " " + cloud_config + " " + runtime_config + " " + admission_control + " " + service_cluster_ip_range + " " + client_ca_file + basic_auth_file + " " + min_request_timeout -%} cluster/saltbase/salt/kube-controller-manager/kube-controller-manager.manifest:{% set params = "--master=127.0.0.1:8080" + " " + cluster_name + " " + cluster_cidr + " " + allocate_node_cidrs + " " + terminated_pod_gc + " " + cloud_provider + " " + cloud_config + " " + service_account_key + " " + log_level + " " + root_ca_file -%} cluster/saltbase/salt/kube-proxy/kube-proxy.manifest: {% set api_servers_with_port = api_servers + ":6443" -%} cluster/saltbase/salt/kube-proxy/kube-proxy.manifest: {% set api_servers_with_port = api_servers -%}