From 98a7311afcf13f78273f0bb101786f5dd1431cd7 Mon Sep 17 00:00:00 2001 From: Isaac Hollander McCreery Date: Thu, 24 Aug 2017 11:33:23 -0700 Subject: [PATCH] Block instance identity, block recursive=true --- .../gce/metadata-proxy-configmap.yaml | 34 ++++++++++++++++--- 1 file changed, 30 insertions(+), 4 deletions(-) diff --git a/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml b/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml index 5be4cbe3b61..af8b8c974b5 100644 --- a/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml +++ b/cluster/addons/metadata-proxy/gce/metadata-proxy-configmap.yaml @@ -23,37 +23,63 @@ data: # By default, return 403. This protects us from new API versions. location / { - return 403; + return 403 "This metadata API is not allowed by the metadata proxy."; } # Allow for REST discovery. location = / { + if ($args ~ "recursive=true") { + return 403 "?recursive calls are not allowed by the metadata proxy."; + } proxy_pass http://169.254.169.254; } location = /computeMetadata/ { + if ($args ~ "recursive=true") { + return 403 "?recursive calls are not allowed by the metadata proxy."; + } proxy_pass http://169.254.169.254; } # By default, allow the v0.1, v1beta1, and v1 APIs. location /0.1/ { + if ($args ~ "recursive=true") { + return 403 "?recursive calls are not allowed by the metadata proxy."; + } proxy_pass http://169.254.169.254; } location /computeMetadata/v1beta1/ { + if ($args ~ "recursive=true") { + return 403 "?recursive calls are not allowed by the metadata proxy."; + } proxy_pass http://169.254.169.254; } location /computeMetadata/v1/ { + if ($args ~ "recursive=true") { + return 403 "?recursive calls are not allowed by the metadata proxy."; + } proxy_pass http://169.254.169.254; } # Return a 403 for the kube-env attribute in all allowed API versions. location /0.1/meta-data/attributes/kube-env { - return 403; + return 403 "This metadata endpoint is concealed."; } location /computeMetadata/v1beta1/instance/attributes/kube-env { - return 403; + return 403 "This metadata endpoint is concealed."; } location /computeMetadata/v1/instance/attributes/kube-env { - return 403; + return 403 "This metadata endpoint is concealed."; + } + + # Return a 403 for instance identity in all allowed API versions. + location ~ /0.1/meta-data/service-accounts/.+/identity { + return 403 "This metadata endpoint is concealed."; + } + location ~ /computeMetadata/v1beta1/instance/service-accounts/.+/identity { + return 403 "This metadata endpoint is concealed."; + } + location ~ /computeMetadata/v1/instance/service-accounts/.+/identity { + return 403 "This metadata endpoint is concealed."; } } }