[kibana] optionally disable SA token automount #1301

jonkerj · 2021-07-20T08:49:51Z

Benefits

By disabling the automount, potential attackers cannot access the Kubernetes API on behalf/through the pod.

Possible drawbacks

If anyone is using some sidecar or plugin to access the Kubernetes API, they will have to explicitly enable (--set automountToken=true) the automount of the SA token in the values.

Applicable issues

#1330

Chart version not bumped (the versions are all bumped and released at the same time)
README.md updated with any new values or changes
Updated template tests in ${CHART}/tests/*.py
Updated integration tests in ${CHART}/examples/*/test/goss.yaml

elasticmachine · 2021-07-20T08:49:53Z

Since this is a community submitted pull request, a Jenkins build has not been kicked off automatically. Can an Elastic organization member please verify the contents of this patch and then kick off a build manually?

jonkerj · 2021-08-16T04:08:16Z

Hi devs, is there anything I can do to get this ball rolling?

jonkerj · 2021-08-27T08:11:49Z

Rebased/cherry-picked to 7.14

jonkerj · 2021-09-02T14:38:48Z

Hi devs, I'd really like someone to take a look at this security fix. Is there anything I can do to get this fixed?

jonkerj · 2021-09-13T07:42:10Z

@jmlrt any chance you could take a look at this PR? Looks like you are an active dev here, and I'd really like this feature at least considered 😉

jmlrt

Hi @jonkerj, sorry for the late answer.
This PR makes sense, however I have a few comments:

unless cases where a change is only valid for a specific version, PR should be opened to master branch then Elastic handle the backport to the other branches
the default value should be True to avoid a breaking change

Also I don't know if we should migrate the way we configure service accounts to be like elasticsearch chart with a rbac value before this change. I would to think about it.

cla-checker-service · 2021-09-20T08:40:09Z

💚 CLA has been signed

jonkerj · 2021-09-20T08:47:07Z

Hi there, same here: I've (re)signed the CLA, rebased and changed the default. Should be good now

jmlrt

LGTM⛴

jmlrt · 2021-09-20T09:13:59Z

jenkins test this please

jmlrt

Some changes are required to make Black formatter happy in elastic+helm-charts+pull-request+lint-python/1092.

Can you run black kibana/tests/kibana_test.py?

Kibana has no direct interaction with the Kubernetes API, and as such, it does not need a mounted service account token in its pods. By disabling this automount, potential attackers cannot access the API on behalf/through the Pod. This commit allows users to opt out on SA token automount, but leaves leaves current behaviour untouched to avoid breaking things. Signed-off-by: Jorik Jonker <jorik.jonker@eu.equinix.com>

jonkerj · 2021-09-20T13:19:55Z

done

jmlrt · 2021-09-20T13:26:33Z

jenkins test this please

jonkerj · 2021-10-01T07:20:45Z

@jmlrt : is there anything else I can do?

jmlrt · 2021-10-01T08:26:17Z

Hi @jonkerj, sorry the PR is approved but CI tests are broken for now.
I'll admin-merge it because I don't have time to fix the jobs for now.

Kibana has no direct interaction with the Kubernetes API, and as such, it does not need a mounted service account token in its pods. By disabling this automount, potential attackers cannot access the API on behalf/through the Pod. This commit allows users to opt out on SA token automount, but leaves leaves current behaviour untouched to avoid breaking things. Signed-off-by: Jorik Jonker <jorik.jonker@eu.equinix.com>

Kibana has no direct interaction with the Kubernetes API, and as such, it does not need a mounted service account token in its pods. By disabling this automount, potential attackers cannot access the API on behalf/through the Pod. This commit allows users to opt out on SA token automount, but leaves leaves current behaviour untouched to avoid breaking things. Signed-off-by: Jorik Jonker <jorik.jonker@eu.equinix.com> Co-authored-by: Jorik Jonker <jorik@kippendief.biz>

cospeedster · 2022-10-26T12:31:36Z

Also I don't know if we should migrate the way we configure service accounts to be like elasticsearch chart with a rbac value before this change. I would to think about it.

@jmlrt I opened #1713 to do so and added serviceaccount creation like in elasticsearch except rolebindings and roles.

jonkerj mentioned this pull request Aug 23, 2021

[kibana / elasticsearch] kubernetes service account token is mounted in pod #1330

Closed

jonkerj force-pushed the kibana-opt-mount-sa-token branch from 5f6586b to 70803f2 Compare August 27, 2021 08:09

jonkerj changed the base branch from 7.13 to 7.14 August 27, 2021 08:10

jmlrt suggested changes Sep 16, 2021

View reviewed changes

jmlrt added enhancement New feature or request kibana labels Sep 16, 2021

jonkerj force-pushed the kibana-opt-mount-sa-token branch from 70803f2 to a438600 Compare September 20, 2021 08:39

jonkerj changed the base branch from 7.14 to master September 20, 2021 08:46

jonkerj force-pushed the kibana-opt-mount-sa-token branch from a438600 to 44b4c5c Compare September 20, 2021 08:49

jonkerj changed the title ~~[kibana] optionally enable SA token automount~~ [kibana] optionally disable SA token automount Sep 20, 2021

jmlrt approved these changes Sep 20, 2021

View reviewed changes

jmlrt suggested changes Sep 20, 2021

View reviewed changes

jonkerj force-pushed the kibana-opt-mount-sa-token branch from 44b4c5c to b2dbad1 Compare September 20, 2021 12:59

jmlrt added need-backport v7.16.0 labels Oct 1, 2021

jmlrt merged commit a5fdd4f into elastic:master Oct 12, 2021

jmlrt removed the v7.16.0 label Dec 13, 2021

jmlrt mentioned this pull request Dec 14, 2021

[kibana] optionally disable SA token automount (#1301) #1481

Merged

jmlrt added backported and removed need-backport labels Dec 14, 2021

jmlrt mentioned this pull request Mar 8, 2022

7.17.1 bump #1609

Merged

jmlrt mentioned this pull request Apr 21, 2022

7.17.3 bump #1649

Merged

This was referenced Sep 14, 2022

[meta] fix yaml indent #1698

Merged

[meta] follow-up of #1698 #1700

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[kibana] optionally disable SA token automount #1301

[kibana] optionally disable SA token automount #1301

jonkerj commented Jul 20, 2021 •

edited

Loading

elasticmachine commented Jul 20, 2021

jonkerj commented Aug 16, 2021

jonkerj commented Aug 27, 2021

jonkerj commented Sep 2, 2021

jonkerj commented Sep 13, 2021

jmlrt left a comment

cla-checker-service bot commented Sep 20, 2021 •

edited

Loading

jonkerj commented Sep 20, 2021

jmlrt left a comment

jmlrt commented Sep 20, 2021

jmlrt left a comment

jonkerj commented Sep 20, 2021

jmlrt commented Sep 20, 2021

jonkerj commented Oct 1, 2021

jmlrt commented Oct 1, 2021

cospeedster commented Oct 26, 2022

[kibana] optionally disable SA token automount #1301

[kibana] optionally disable SA token automount #1301

Conversation

jonkerj commented Jul 20, 2021 • edited Loading

Benefits

Possible drawbacks

Applicable issues

elasticmachine commented Jul 20, 2021

jonkerj commented Aug 16, 2021

jonkerj commented Aug 27, 2021

jonkerj commented Sep 2, 2021

jonkerj commented Sep 13, 2021

jmlrt left a comment

Choose a reason for hiding this comment

cla-checker-service bot commented Sep 20, 2021 • edited Loading

jonkerj commented Sep 20, 2021

jmlrt left a comment

Choose a reason for hiding this comment

jmlrt commented Sep 20, 2021

jmlrt left a comment

Choose a reason for hiding this comment

jonkerj commented Sep 20, 2021

jmlrt commented Sep 20, 2021

jonkerj commented Oct 1, 2021

jmlrt commented Oct 1, 2021

cospeedster commented Oct 26, 2022

jonkerj commented Jul 20, 2021 •

edited

Loading

cla-checker-service bot commented Sep 20, 2021 •

edited

Loading