Skip to content

[v0.4] s4: Fixes 374 #408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
raulcabello merged 2 commits into from
Jun 19, 2024
Merged

[v0.4] s4: Fixes 374 #408

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
09b3965
[v0.4.6] s4: Fixes 374 (#392)
pmatseykanets Jun 11, 2024
1d85128
bump rancher to commit 2145c8e9d6034579caa6279856c59679f1102cf3
raulcabello Jun 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions docs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,9 @@ If yes, the webhook redacts the role, so that it only grants a deletion permissi

#### Escalation Prevention

Users can only create/update ClusterRoleTemplateBindings which grant permissions to RoleTemplates with rights less than or equal to those they currently possess. This is to prevent privilege escalation.
Users can only create/update ClusterRoleTemplateBindings which grant permissions to RoleTemplates with rights less than or equal to those they currently possess. This is to prevent privilege escalation.
For external RoleTemplates (RoleTemplates with `external` set to `true`), if the `external-rules` feature flag is enabled and `ExternalRules` is specified in the roleTemplate in `RoleTemplateName`,
`ExternalRules` will be used for authorization. Otherwise (if the feature flag is off or `ExternalRules` are nil), the rules from the backing `ClusterRole` in the local cluster will be used.

#### Invalid Fields - Create

Expand Down Expand Up @@ -90,6 +92,7 @@ In addition, as in the create validation, both a user subject and a group subjec
#### On update

The desired value must not change on new spec unless it's equal to the `lockedValue` or `lockedValue` is nil.
Due to the security impact of the `external-rules` feature flag, only users with admin permissions (`*` verbs on `*` resources in `*` APIGroups in all namespaces) can enable or disable this feature flag.

## FleetWorkspace

Expand Down Expand Up @@ -207,6 +210,8 @@ Adds the authz.management.cattle.io/creator-role-bindings annotation.

Users can only create/update ProjectRoleTemplateBindings with rights less than or equal to those they currently possess.
This is to prevent privilege escalation.
For external RoleTemplates (RoleTemplates with `external` set to `true`), if the `external-rules` feature flag is enabled and `ExternalRules` is specified in the roleTemplate in `RoleTemplateName`,
`ExternalRules` will be used for authorization. Otherwise, if `ExternalRules` are nil when the feature flag is on, the rules from the backing `ClusterRole` in the local cluster will be used.

#### Invalid Fields - Create

Expand Down Expand Up @@ -256,11 +261,12 @@ Circular references to a `RoleTemplate` (a inherits b, b inherits a) are not all

#### Rules Without Verbs, Resources, API groups

Rules without verbs, resources, or apigroups are not permitted. The `rules` included in a RoleTemplate are of the same type as the rules used by standard Kubernetes RBAC types (such as `Roles` from `rbac.authorization.k8s.io/v1`). Because of this, they inherit the same restrictions as these types, including this one.
Rules without verbs, resources, or apigroups are not permitted. The `rules` and `externalRules` included in a RoleTemplate are of the same type as the rules used by standard Kubernetes RBAC types (such as `Roles` from `rbac.authorization.k8s.io/v1`). Because of this, they inherit the same restrictions as these types, including this one.

#### Escalation Prevention

Users can only change RoleTemplates with rights less than or equal to those they currently possess. This prevents privilege escalation.
Users can't create external RoleTemplates (or update existing RoleTemplates) with `ExternalRules` without having the `escalate` verb on that RoleTemplate.

#### Context Validation

Expand Down
49 changes: 24 additions & 25 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,19 @@ require (
github.com/gorilla/mux v1.8.0
github.com/rancher/dynamiclistener v0.4.0-rc2
github.com/rancher/lasso v0.0.0-20240123150939-7055397d6dfa
github.com/rancher/rancher/pkg/apis v0.0.0-20240507213626-07f244b8be3a
github.com/rancher/rke v1.5.9-rc2
github.com/rancher/rancher/pkg/apis v0.0.0-20240618132447-2145c8e9d603
github.com/rancher/rke v1.5.11-rc1
github.com/rancher/wrangler/v2 v2.1.4
github.com/sirupsen/logrus v1.9.3
github.com/stretchr/testify v1.8.4
golang.org/x/exp v0.0.0-20230905200255-921286631fa9
golang.org/x/text v0.14.0
golang.org/x/tools v0.16.1
k8s.io/api v0.28.6
k8s.io/apimachinery v0.28.6
k8s.io/apiserver v0.28.6
golang.org/x/text v0.15.0
golang.org/x/tools v0.20.0
k8s.io/api v0.28.8
k8s.io/apimachinery v0.28.8
k8s.io/apiserver v0.28.8
k8s.io/client-go v12.0.0+incompatible
k8s.io/kubernetes v1.28.6
k8s.io/kubernetes v1.28.8
k8s.io/pod-security-admission v0.28.6
k8s.io/utils v0.0.0-20230726121419-3b25d923346b
sigs.k8s.io/controller-runtime v0.15.3
Expand All @@ -74,14 +74,14 @@ require (
github.com/felixge/httpsnoop v1.0.3 // indirect
github.com/fsnotify/fsnotify v1.6.0 // indirect
github.com/ghodss/yaml v1.0.0 // indirect
github.com/go-logr/logr v1.3.0 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/jsonpointer v0.20.0 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/swag v0.22.4 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/cel-go v0.16.1 // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.6.0 // indirect
Expand All @@ -105,10 +105,10 @@ require (
github.com/prometheus/client_model v0.4.1-0.20230718164431-9a2bf3000d16 // indirect
github.com/prometheus/common v0.44.0 // indirect
github.com/prometheus/procfs v0.11.1 // indirect
github.com/rancher/aks-operator v1.2.1 // indirect
github.com/rancher/eks-operator v1.3.1 // indirect
github.com/rancher/aks-operator v1.2.2 // indirect
github.com/rancher/eks-operator v1.3.2 // indirect
github.com/rancher/fleet/pkg/apis v0.9.1-rc.2.0.20240213164401-2c6b1019687c // indirect
github.com/rancher/gke-operator v1.2.1 // indirect
github.com/rancher/gke-operator v1.2.2 // indirect
github.com/rancher/norman v0.0.0-20240206180703-6eda4bc94b4c // indirect
github.com/spf13/cobra v1.7.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
Expand All @@ -129,29 +129,28 @@ require (
go.uber.org/atomic v1.10.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.24.0 // indirect
golang.org/x/crypto v0.19.0 // indirect
golang.org/x/mod v0.14.0 // indirect
golang.org/x/net v0.21.0 // indirect
golang.org/x/oauth2 v0.16.0 // indirect
golang.org/x/sync v0.5.0 // indirect
golang.org/x/sys v0.17.0 // indirect
golang.org/x/term v0.17.0 // indirect
golang.org/x/crypto v0.23.0 // indirect
golang.org/x/mod v0.17.0 // indirect
golang.org/x/net v0.25.0 // indirect
golang.org/x/oauth2 v0.20.0 // indirect
golang.org/x/sync v0.7.0 // indirect
golang.org/x/sys v0.20.0 // indirect
golang.org/x/term v0.20.0 // indirect
golang.org/x/time v0.5.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
google.golang.org/appengine v1.6.8 // indirect
google.golang.org/genproto v0.0.0-20231106174013-bbf56f31fb17 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20231120223509-83a465c0220f // indirect
google.golang.org/grpc v1.59.0 // indirect
google.golang.org/protobuf v1.31.0 // indirect
google.golang.org/protobuf v1.33.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiextensions-apiserver v0.28.6 // indirect
k8s.io/apiextensions-apiserver v0.28.8 // indirect
k8s.io/cloud-provider v0.0.0 // indirect
k8s.io/code-generator v0.28.6 // indirect
k8s.io/component-base v0.28.6 // indirect
k8s.io/code-generator v0.28.8 // indirect
k8s.io/component-base v0.28.8 // indirect
k8s.io/component-helpers v0.28.6 // indirect
k8s.io/controller-manager v0.28.6 // indirect
k8s.io/gengo v0.0.0-20230829151522-9cce18d56c01 // indirect
Expand Down
Loading