diff --git a/plugin/pkg/admission/serviceaccount/admission.go b/plugin/pkg/admission/serviceaccount/admission.go index 543604c9e5b..f7653a83894 100644 --- a/plugin/pkg/admission/serviceaccount/admission.go +++ b/plugin/pkg/admission/serviceaccount/admission.go @@ -324,6 +324,16 @@ func (s *serviceAccount) limitSecretReferences(serviceAccount *api.ServiceAccoun } } + for _, container := range pod.Spec.Containers { + for _, env := range container.Env { + if env.ValueFrom != nil && env.ValueFrom.SecretKeyRef != nil { + if !mountableSecrets.Has(env.ValueFrom.SecretKeyRef.Name) { + return fmt.Errorf("Container %s with envVar %s referencing secret.secretName=\"%s\" is not allowed because service account %s does not reference that secret", container.Name, env.Name, env.ValueFrom.SecretKeyRef.Name, serviceAccount.Name) + } + } + } + } + // limit pull secret references as well pullSecrets := sets.NewString() for _, s := range serviceAccount.ImagePullSecrets { diff --git a/plugin/pkg/admission/serviceaccount/admission_test.go b/plugin/pkg/admission/serviceaccount/admission_test.go index 855590849bf..0d4488d46a0 100644 --- a/plugin/pkg/admission/serviceaccount/admission_test.go +++ b/plugin/pkg/admission/serviceaccount/admission_test.go @@ -18,6 +18,7 @@ package serviceaccount import ( "reflect" + "strings" "testing" "k8s.io/kubernetes/pkg/admission" @@ -367,7 +368,7 @@ func TestRespectsExistingMount(t *testing.T) { } } -func TestAllowsReferencedSecretVolumes(t *testing.T) { +func TestAllowsReferencedSecret(t *testing.T) { ns := "myns" admit := NewServiceAccount(nil) @@ -385,16 +386,39 @@ func TestAllowsReferencedSecretVolumes(t *testing.T) { }, }) - pod := &api.Pod{ + pod1 := &api.Pod{ Spec: api.PodSpec{ Volumes: []api.Volume{ {VolumeSource: api.VolumeSource{Secret: &api.SecretVolumeSource{SecretName: "foo"}}}, }, }, } - attrs := admission.NewAttributesRecord(pod, api.Kind("Pod"), ns, "myname", api.Resource("pods"), "", admission.Create, nil) - err := admit.Admit(attrs) - if err != nil { + attrs := admission.NewAttributesRecord(pod1, api.Kind("Pod"), ns, "myname", api.Resource("pods"), "", admission.Create, nil) + if err := admit.Admit(attrs); err != nil { + t.Errorf("Unexpected error: %v", err) + } + + pod2 := &api.Pod{ + Spec: api.PodSpec{ + Containers: []api.Container{ + { + Name: "container-1", + Env: []api.EnvVar{ + { + Name: "env-1", + ValueFrom: &api.EnvVarSource{ + SecretKeyRef: &api.SecretKeySelector{ + LocalObjectReference: api.LocalObjectReference{Name: "foo"}, + }, + }, + }, + }, + }, + }, + }, + } + attrs = admission.NewAttributesRecord(pod2, api.Kind("Pod"), ns, "myname", api.Resource("pods"), "", admission.Create, nil) + if err := admit.Admit(attrs); err != nil { t.Errorf("Unexpected error: %v", err) } } @@ -414,18 +438,41 @@ func TestRejectsUnreferencedSecretVolumes(t *testing.T) { }, }) - pod := &api.Pod{ + pod1 := &api.Pod{ Spec: api.PodSpec{ Volumes: []api.Volume{ {VolumeSource: api.VolumeSource{Secret: &api.SecretVolumeSource{SecretName: "foo"}}}, }, }, } - attrs := admission.NewAttributesRecord(pod, api.Kind("Pod"), ns, "myname", api.Resource("pods"), "", admission.Create, nil) - err := admit.Admit(attrs) - if err == nil { + attrs := admission.NewAttributesRecord(pod1, api.Kind("Pod"), ns, "myname", api.Resource("pods"), "", admission.Create, nil) + if err := admit.Admit(attrs); err == nil { t.Errorf("Expected rejection for using a secret the service account does not reference") } + + pod2 := &api.Pod{ + Spec: api.PodSpec{ + Containers: []api.Container{ + { + Name: "container-1", + Env: []api.EnvVar{ + { + Name: "env-1", + ValueFrom: &api.EnvVarSource{ + SecretKeyRef: &api.SecretKeySelector{ + LocalObjectReference: api.LocalObjectReference{Name: "foo"}, + }, + }, + }, + }, + }, + }, + }, + } + attrs = admission.NewAttributesRecord(pod2, api.Kind("Pod"), ns, "myname", api.Resource("pods"), "", admission.Create, nil) + if err := admit.Admit(attrs); err == nil || !strings.Contains(err.Error(), "with envVar") { + t.Errorf("Unexpected error: %v", err) + } } func TestAllowUnreferencedSecretVolumesForPermissiveSAs(t *testing.T) {