KEP-2862: Fine-grained Kubelet API Authorization #4760

vinayakankugoyal · 2024-07-12T18:39:29Z

One-line PR description: Adding a new KEP

Issue link: Fine grained Kubelet API authorization #2862

Other comments:

k8s-ci-robot · 2024-07-12T18:39:38Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: vinayakankugoyal
Once this PR has been reviewed and has the lgtm label, please assign mikedanese for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/sig-auth/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

vinayakankugoyal · 2024-07-12T18:42:24Z

/cc @tallclair

sftim · 2024-07-27T19:50:17Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+We propose a change to the Kubelet API authorization to provide more
+fine-grained control. Currently, the API uses a coarse authorization scheme,
+where actions like reading health status and the ability to exec into a pod
+require the same permission.


AIUI, this is a primarily change to the Node API. Does that sound right?

It is a change to the kubelet API. So agents (think logging and monitoring) that interact with the kubelet directly.

sftim · 2024-07-27T19:51:37Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+- Introduce new subresources for `/healthz` and `/pods/` kubelet endpoints,
+allowing for more  granular authorization.


Is this right?

Suggested change

- Introduce new subresources for `/healthz` and `/pods/` kubelet endpoints,

allowing for more granular authorization.

- Introduce new subresources for a Node, `healthz` and `pods`, that are proxied to the kubelet endpoints

`/healthz` and `/pods/` respectively. Making this change allowsfor more granular authorization.

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

sftim · 2024-07-27T19:59:06Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+its user is bound to the `system:kubelet-api-admin` role. When the feature-gate 
+is enabled we will update the `ClusterRole` as follow:-


RBAC is an optional authz mode and we typically can't assume it's active in a cluster. Of course, nearly all clusters do enable RBAC. Anyway:

Suggested change

its user is bound to the `system:kubelet-api-admin` role. When the feature-gate

is enabled we will update the `ClusterRole` as follow:-

in a cluster with RBAC enabled, then its user is mapped to the `system:kubelet-api-admin`

ClusterRole.

For a cluster with the `KubeletFineGrainedAuthz` feature gate enabled, the

`system:kubelet-api-admin` ClusterRole could be changed to look like:

sftim · 2024-07-27T20:00:04Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+  - apiGroups:
+    - ""
+    resources:
+    - nodes
+    verbs:
+    - proxy


This seems to be allowing full access to proxy to all nodes. Is that what we want to demonstrate?

This role already exists and has full access to proxy to all nodes. I just want to demonstrate the additional permissions we will add to this role.

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

sftim · 2024-07-27T20:09:50Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+<!--
+Describe them, providing:
+  - API call type (e.g. PATCH pods)
+  - estimated throughput
+  - originating component(s) (e.g. Kubelet, Feature-X-controller)
+Focusing mostly on:
+  - components listing and/or watching resources they didn't before
+  - API calls that may be triggered by changes of some Kubernetes resources
+    (e.g. update of object X triggers new updates of object Y)
+  - periodic API calls to reconcile state (e.g. periodic fetching state,
+    heartbeats, leader election, etc.)
+-->


(optionally)

Suggested change



For some requests, the API server performs an additional SubjectAccessReview (only when a check

for the `proxy` subresource wasn't authorized).

Signed-off-by: Vinayak Goyal <vinaygo@google.com>

vinayakankugoyal · 2024-07-31T20:22:03Z

/assign @liggitt

SergeyKanzhelev · 2024-07-31T23:08:22Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+### Notes
+
+If this change were to be implemented as proposed, the `proxy` `subresource` 
+would still cover `/attach/`, `/exec/`, `/run/`, `/configz/`, `/debug/`. 


what is the motivation to keep /configz/under proxy? Reading config maybe useful for monitoring tools

SergeyKanzhelev · 2024-07-31T23:28:11Z

keps/sig-auth/2862-fine-grained-kubelet-authz/README.md

+| /pods/                                          | proxy                | proxy, pods              |
+| /runningpods/                                   | proxy                | proxy, pods              |


I don't think we documented those endpoints or have any stability guarantees. Introducing special permissions for those make those endpoints official.

We need to discuss in SIG Node forum whether we want to document those endpoints.

@dchen1107 @mrunalp

Where are the other endpoints documented? Can you point me to those?

just to update this thread: we will have a discussion on SIG Node meeting next week

cc/ @tallclair

shuaich · 2024-08-14T16:26:15Z

Thank you @vinayakankugoyal for this proposal. LGTM.

tallclair · 2024-08-20T17:17:22Z

/assign

ffromani · 2024-08-21T06:27:15Z

/cc

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 12, 2024

k8s-ci-robot requested review from mikedanese and ritazh July 12, 2024 18:39

k8s-ci-robot added kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jul 12, 2024

k8s-ci-robot requested a review from tallclair July 12, 2024 18:42

vinayakankugoyal force-pushed the kep2862 branch 3 times, most recently from cb4f550 to 8c66ffa Compare July 12, 2024 21:32

vinayakankugoyal mentioned this pull request Jul 17, 2024

Fine grained Kubelet API authorization #2862

Open

4 tasks

vinayakankugoyal force-pushed the kep2862 branch from 8c66ffa to b23608f Compare July 17, 2024 23:18

vinayakankugoyal marked this pull request as draft July 17, 2024 23:21

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 17, 2024

vinayakankugoyal force-pushed the kep2862 branch from b23608f to 97cef1b Compare July 19, 2024 21:10

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Jul 19, 2024

vinayakankugoyal force-pushed the kep2862 branch from 97cef1b to e96fad8 Compare July 19, 2024 21:25

k8s-ci-robot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Jul 19, 2024

vinayakankugoyal force-pushed the kep2862 branch 3 times, most recently from ee772b8 to a29ca76 Compare July 19, 2024 22:18

vinayakankugoyal marked this pull request as ready for review July 24, 2024 17:26

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 24, 2024

k8s-ci-robot requested a review from enj July 24, 2024 17:26

vinayakankugoyal force-pushed the kep2862 branch from a29ca76 to 2a92135 Compare July 25, 2024 05:39

sftim reviewed Jul 27, 2024

View reviewed changes

vinayakankugoyal force-pushed the kep2862 branch 2 times, most recently from e5283d2 to 9207765 Compare July 31, 2024 20:20

KEP-2862: Fine-grained Kubelet API Authorization

608bac3

Signed-off-by: Vinayak Goyal <vinaygo@google.com>

vinayakankugoyal force-pushed the kep2862 branch from 9207765 to 608bac3 Compare July 31, 2024 20:21

k8s-ci-robot assigned liggitt Jul 31, 2024

SergeyKanzhelev reviewed Jul 31, 2024

View reviewed changes

k8s-ci-robot assigned tallclair Aug 20, 2024

k8s-ci-robot requested a review from ffromani August 21, 2024 06:27

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

KEP-2862: Fine-grained Kubelet API Authorization #4760

KEP-2862: Fine-grained Kubelet API Authorization #4760

vinayakankugoyal commented Jul 12, 2024

k8s-ci-robot commented Jul 12, 2024

vinayakankugoyal commented Jul 12, 2024

sftim Jul 27, 2024

vinayakankugoyal Jul 30, 2024

sftim Jul 27, 2024

sftim Jul 27, 2024

sftim Jul 27, 2024

vinayakankugoyal Jul 29, 2024

sftim Jul 27, 2024

vinayakankugoyal commented Jul 31, 2024

SergeyKanzhelev Jul 31, 2024

SergeyKanzhelev Jul 31, 2024

vinayakankugoyal Aug 1, 2024

SergeyKanzhelev Aug 14, 2024

dchen1107 Aug 20, 2024

shuaich commented Aug 14, 2024

tallclair commented Aug 20, 2024

ffromani commented Aug 21, 2024

		- Introduce new subresources for `/healthz` and `/pods/` kubelet endpoints,
		allowing for more granular authorization.

		its user is bound to the `system:kubelet-api-admin` role. When the feature-gate
		is enabled we will update the `ClusterRole` as follow:-

-its user is bound to the `system:kubelet-api-admin` role. When the feature-gate
-is enabled we will update the `ClusterRole` as follow:-
+in a cluster with RBAC enabled, then its user is mapped to the `system:kubelet-api-admin`
+ClusterRole.
+For a cluster with the `KubeletFineGrainedAuthz` feature gate enabled, the
+`system:kubelet-api-admin` ClusterRole could be changed to look like:

		\| /pods/ \| proxy \| proxy, pods \|
		\| /runningpods/ \| proxy \| proxy, pods \|

KEP-2862: Fine-grained Kubelet API Authorization #4760

Are you sure you want to change the base?

KEP-2862: Fine-grained Kubelet API Authorization #4760

Conversation

vinayakankugoyal commented Jul 12, 2024

k8s-ci-robot commented Jul 12, 2024

vinayakankugoyal commented Jul 12, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vinayakankugoyal commented Jul 31, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

shuaich commented Aug 14, 2024

tallclair commented Aug 20, 2024

ffromani commented Aug 21, 2024