Added project id to kubeadmin user for Kubernetes service #10362
Conversation
|
Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
|
| String projectId = "default"; | ||
| Account account = ApiDBUtils.findAccountById(kubernetesCluster.getAccountId()); | ||
| Project project = ApiDBUtils.findProjectByProjectAccountId(account.getId()); | ||
| if ( project != null ) { | ||
| projectId = project.getUuid(); | ||
| } | ||
|
|
||
| String username = owner.getAccountName() + "-" + projectId + "-" + KUBEADMIN_ACCOUNT_NAME; |
There was a problem hiding this comment.
does this mean accounts cannot have a kubernetes instance without being part of a project? I would expect something like
| String projectId = "default"; | |
| Account account = ApiDBUtils.findAccountById(kubernetesCluster.getAccountId()); | |
| Project project = ApiDBUtils.findProjectByProjectAccountId(account.getId()); | |
| if ( project != null ) { | |
| projectId = project.getUuid(); | |
| } | |
| String username = owner.getAccountName() + "-" + projectId + "-" + KUBEADMIN_ACCOUNT_NAME; | |
| String projectId = null; | |
| Account account = ApiDBUtils.findAccountById(kubernetesCluster.getAccountId()); | |
| Project project = ApiDBUtils.findProjectByProjectAccountId(account.getId()); | |
| if ( project != null ) { | |
| projectId = project.getUuid(); | |
| } | |
| String username = owner.getAccountName() + (projectId == null ? : "" : "-" + projectId) + "-" + KUBEADMIN_ACCOUNT_NAME; |
There was a problem hiding this comment.
That's a good idea. Will update the code as such. In our case, we always have projectId.
| @@ -1384,7 +1384,15 @@ private String[] getServiceUserKeys(KubernetesClusterVO kubernetesCluster) { | |||
| if (owner == null || owner.getType() == Account.Type.PROJECT) { | |||
| owner = CallContext.current().getCallingAccount(); | |||
| } | |||
| String username = owner.getAccountName() + "-" + KUBEADMIN_ACCOUNT_NAME; | |||
There was a problem hiding this comment.
@parkinr
can you explain more ?
- without this PR, what's the username ?
- with this PR, what's the username ?
There was a problem hiding this comment.
Without this PR, the username is: flexcloud-admin-account-kubeadmin
With this PR, the username is flexcloud-admin-account-f316789i-2bgg-4r87-95h7-58j5327892ef-kubeadmin with sample projectId=f316789i-2bgg-4r87-95h7-58j5327892ef. And you can see this projectId in cloudstack-secret on the Kubernetes cluster.
There was a problem hiding this comment.
thanks @parkinr for the reply.
However, the security issue is not resolved I think.
@DaanHoogland
we may need to treat this as a serious security issue.
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #10362 +/- ##
=============================================
- Coverage 16.08% 4.01% -12.08%
=============================================
Files 5659 395 -5264
Lines 496856 32452 -464404
Branches 60168 5743 -54425
=============================================
- Hits 79933 1302 -78631
+ Misses 407978 31001 -376977
+ Partials 8945 149 -8796
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
|
@parkinr Since it is a serious issue, the community will work on a fix |
Description
When Kubernetes cluster is created, a kubeadmin user is created without projectId. The cloudstack-secret created on the Kubernetes cluster can be used by all users with the same account. That could pose security issue with sharing api-key and secret-key. This PR added projectId to the kubeadmin user so that the api-key and secret-key will only be shared within the project.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
Created a Kubernetes cluster with the modified code. Made sure the kubeadmin user has the projectId included. Also checked cloudstack-secret on the Kubernetes cluster to make sure project id is part of the cloudstack-secret with api-key and secret-key.
How did you try to break this feature and the system with this change?
Without the change, the kubeadmin user can access resources from the account level. With this change, this kubeadmin user can only manage resources for that project.