[WIP] 🌱 Change crt permissions in KCP to 0600#12648
[WIP] 🌱 Change crt permissions in KCP to 0600#12648sbueringer wants to merge 1 commit intokubernetes-sigs:mainfrom
Conversation
Signed-off-by: Stefan Büringer [email protected]
k8s-ci-robot
added
the
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
k8s-ci-robot
added
cncf-cla: yes
sbueringer
added
the
area/provider/control-plane-kubeadm
| Path: c.CertFile, | ||
| Owner: rootOwnerValue, | ||
| Permissions: "0640", | ||
| Permissions: "0600", |
There was a problem hiding this comment.
Context:
- the latest CIS 1.10 profile suggests to use 0600 for these certificates: https://github.com/aquasecurity/kube-bench/blob/main/cfg/cis-1.10/master.yaml#L292-L306
- kubeadm uses 0644 today: https://github.com/kubernetes/kubernetes/blob/88dfa51b6003c90e8f0a0508939a1d79950a40df/staging/src/k8s.io/client-go/util/cert/io.go#L68-L67
I wonder if 0600 leads to problems with: kubernetes/kubeadm#2473 (comment)
@neolit123 What do you think?
Is there a way that I can verify this works with userns? Do I only have to use Kubernetes >= 1.33?
There was a problem hiding this comment.
if i understand how userns works, this might be fine. you can test with any new release that has userns support. i don't think we ever tested kubeadm with userns yet, fwiw.
they are still fixing bugs and updating docs for the feature and we need it to be ga.
There was a problem hiding this comment.
also, cis has been annoying since it doesn't consider permissions of the parent dir. distributions on top of kubeadm and capi ca choose to generate their own certs, but that's extra work.
There was a problem hiding this comment.
I was wondering if "userns is being enabled by default in 1.33" (kubernetes/kubeadm#2473 (comment)) means that it's also used for static Pods per default
There was a problem hiding this comment.
it's enabled in core k8s, but pod users must opt-in; kubeadm hasn't yet.
|
/test pull-cluster-api-e2e-main |
|
The Kubernetes project currently lacks enough contributors to adequately respond to all PRs. This bot triages PRs according to the following rules:
You can:
Please send feedback to sig-contributor-experience at kubernetes/community. /lifecycle stale |
k8s-ci-robot
added
the
lifecycle/stale
|
/close Might revive this later, not sure yet |
|
@sbueringer: Closed this PR. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
Signed-off-by: Stefan Büringer [email protected]
What this PR does / why we need it:
Which issue(s) this PR fixes (optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close the issue(s) when PR gets merged):Fixes #