C12s/c12s-kubespray
3
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix inconsistent handling of admission plugin list (#9407)

Browse source 
* Fix inconsistent handling of admission plugin list

* Adjust hardening doc with the normalized admission plugin list

* Add pre-check for admission plugins format change

* Ignore checking admission plugins value when variable is not defined
This commit is contained in:
William Turner 2022-10-26 03:28:37 -04:00 committed by GitHub
parent ef707b3461
commit eeb376460d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
5 changed files with 34 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
docs/hardening.md
View file

@ -41,7 +41,18 @@ kube_encrypt_secret_data: true
kube_encryption_resources: [secrets] kube_encryption_resources: [secrets]
kube_encryption_algorithm: "secretbox" kube_encryption_algorithm: "secretbox"
kube_apiserver_enable_admission_plugins: ['EventRateLimit,AlwaysPullImages,ServiceAccount,NamespaceLifecycle,NodeRestriction,LimitRanger,ResourceQuota,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,PodNodeSelector,PodSecurity'] kube_apiserver_enable_admission_plugins:
- EventRateLimit
- AlwaysPullImages
- ServiceAccount
- NamespaceLifecycle
- NodeRestriction
- LimitRanger
- ResourceQuota
- MutatingAdmissionWebhook
- ValidatingAdmissionWebhook
- PodNodeSelector
- PodSecurity
kube_apiserver_admission_control_config_file: true kube_apiserver_admission_control_config_file: true
# EventRateLimit plugin configuration # EventRateLimit plugin configuration
kube_apiserver_admission_event_rate_limits: kube_apiserver_admission_event_rate_limits:

2
roles/kubernetes/control-plane/tasks/kubeadm-setup.yml
View file

@ -106,7 +106,7 @@
when: when:
- kube_apiserver_admission_control_config_file - kube_apiserver_admission_control_config_file
- item in kube_apiserver_admission_plugins_needs_configuration - item in kube_apiserver_admission_plugins_needs_configuration
loop: "{{ kube_apiserver_enable_admission_plugins[0].split(',') }}" loop: "{{ kube_apiserver_enable_admission_plugins }}"
- name: kubeadm | Check if apiserver.crt contains all needed SANs - name: kubeadm | Check if apiserver.crt contains all needed SANs
shell: | shell: |

2
roles/kubernetes/control-plane/templates/admission-controls.yaml.j2
View file

@ -1,7 +1,7 @@
apiVersion: apiserver.config.k8s.io/v1 apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration kind: AdmissionConfiguration
plugins: plugins:
{% for plugin in kube_apiserver_enable_admission_plugins[0].split(',') %} {% for plugin in kube_apiserver_enable_admission_plugins %}
{% if plugin in kube_apiserver_admission_plugins_needs_configuration %} {% if plugin in kube_apiserver_admission_plugins_needs_configuration %}
- name: {{ plugin }} - name: {{ plugin }}
path: {{ kube_config_dir }}/{{ plugin|lower }}.yaml path: {{ kube_config_dir }}/{{ plugin|lower }}.yaml

8
roles/kubernetes/preinstall/tasks/0020-verify-settings.yml
View file

@ -305,3 +305,11 @@
when: when:
- kube_external_ca_mode - kube_external_ca_mode
- not ignore_assert_errors - not ignore_assert_errors
- name: Stop if using deprecated comma separated list for admission plugins
assert:
that: "',' not in kube_apiserver_enable_admission_plugins[0]"
msg: "Comma-separated list for kube_apiserver_enable_admission_plugins is now deprecated, use separate list items for each plugin."
when:
- kube_apiserver_enable_admission_plugins is defined
- kube_apiserver_enable_admission_plugins | length > 0

13
tests/files/packet_ubuntu20-calico-aio-hardening.yml
View file

@ -36,7 +36,18 @@ kube_encrypt_secret_data: true
kube_encryption_resources: [secrets] kube_encryption_resources: [secrets]
kube_encryption_algorithm: "secretbox" kube_encryption_algorithm: "secretbox"
kube_apiserver_enable_admission_plugins: ['EventRateLimit,AlwaysPullImages,ServiceAccount,NamespaceLifecycle,NodeRestriction,LimitRanger,ResourceQuota,MutatingAdmissionWebhook,ValidatingAdmissionWebhook,PodNodeSelector,PodSecurity'] kube_apiserver_enable_admission_plugins:
- EventRateLimit
- AlwaysPullImages
- ServiceAccount
- NamespaceLifecycle
- NodeRestriction
- LimitRanger
- ResourceQuota
- MutatingAdmissionWebhook
- ValidatingAdmissionWebhook
- PodNodeSelector
- PodSecurity
kube_apiserver_admission_control_config_file: true kube_apiserver_admission_control_config_file: true
# EventRateLimit plugin configuration # EventRateLimit plugin configuration
kube_apiserver_admission_event_rate_limits: kube_apiserver_admission_event_rate_limits: