New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: block local auth for neuvector #965

Open

rjferguson21 wants to merge 2 commits into main from neuvector-admin-lock

+30 −0

Contributor

rjferguson21 commented Oct 25, 2024

Description

Ensure Neuvector local auth is inaccessible:

Via Istio AuthorizationPolicy DENY to /auth on the manager pod
Adds additional precaution to randomize admin user password

In theory Neuvector should not create an a local admin user as configured by

uds-core/src/neuvector/values/values.yaml

Lines 28 to 30 in c8d66fd

    
           env: 
        
             - name: NO_DEFAULT_ADMIN 
        
               value: "1"

but it does not seem to honored at the moment.

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Other (security config, docs update, etc)

Checklist before merging

Test, docs, adr added or updated as needed
Contributor Guide followed


          chore: block local auth for neuvector

e631ad1

rjferguson21 requested a review from a team as a code owner

October 25, 2024 20:50


          fix helm deny template

476c0a5

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet