Skip to content

Add PSA for blocking .host on pod probes #125271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Add PSA for blocking .host on pod probes #125271

wants to merge 1 commit into from
+104 −0

Conversation

tssurya
Copy link
Contributor

@tssurya tssurya commented Jun 1, 2024 •
edited
Loading

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR aims to add the following fields as part of PSA so that users can be blocked/warned when they create probes with the .Host field set.

container.LivenessProbe.ProbeHandler.HTTPGet.Host
container.ReadinessProbe.ProbeHandler.HTTPGet.Host
container.StartupProbe.ProbeHandler.HTTPGet.Host
container.LivenessProbe.ProbeHandler.TCPSocket.Host
container.ReadinessProbe.ProbeHandler.TCPSocket.Host
container.StartupProbe.ProbeHandler.TCPSocket.Host
container.Lifecycle.PostStart.TCPSocket.Host // Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept for backward compatibility.
container.Lifecycle.PreStop.TCPSocket.Host // Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept for backward compatibility.
container.Lifecycle.PostStart.HTTPGet.Host
container.Lifecycle.PreStop.HTTPGet.Host

Which issue(s) this PR fixes:

Fixes #99425

Special notes for your reviewer:

This is my first PR to pod-security-admission area, so I might need some hand-holding, but I will mark the PR as draft till I get all the pieces done.

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Please use the following format for linking documentation:

@k8s-ci-robot
Copy link
Contributor

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@k8s-ci-robot
Copy link
Contributor

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. kind/bug Categorizes issue or PR as related to a bug. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Jun 1, 2024
@k8s-ci-robot k8s-ci-robot requested review from deads2k and krmayankk June 1, 2024 19:37
@k8s-ci-robot k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Jun 1, 2024
@tssurya tssurya mentioned this pull request Jun 6, 2024
Open
@tssurya tssurya force-pushed the psa-probe-lifecycle-handler-host-option branch 2 times, most recently from 7ff5459 to 24e1078 Compare July 17, 2024 16:02
@tssurya tssurya changed the title Add PSS for blocking .host on pod probes Add PSA for blocking .host on pod probes Jul 17, 2024
deads2k
deads2k reviewed Jul 17, 2024
View reviewed changes
staging/src/k8s.io/pod-security-admission/policy/check_probes.go
Level: api.LevelBaseline,
Versions: []VersionedCheck{
{
MinimumVersion: api.MajorMinorVersion(1, 0),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this version is the version where the restriction is enforced.

@ibihim
Copy link
Contributor

ibihim commented Sep 9, 2024

/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Sep 9, 2024
@tssurya tssurya mentioned this pull request Oct 31, 2024
Open
4 tasks
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

  • Mark this PR as fresh with /remove-lifecycle stale
  • Close this PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 29, 2025
@tssurya
Copy link
Contributor Author

tssurya commented Jan 29, 2025

/remove-lifecycle stale

@k8s-ci-robot k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jan 29, 2025
@tssurya tssurya force-pushed the psa-probe-lifecycle-handler-host-option branch from 24e1078 to cc1d5c7 Compare March 24, 2025 09:37
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tssurya
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@liggitt liggitt self-assigned this May 21, 2025
@liggitt liggitt added this to the v1.34 milestone Jun 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@deads2k deads2k deads2k left review comments

@krmayankk krmayankk Awaiting requested review from krmayankk

Assignees

@liggitt liggitt

Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/bug Categorizes issue or PR as related to a bug. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. sig/auth Categorizes an issue or PR as relevant to SIG Auth. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Auth
Status: In Review
[sig-release] Bug Triage
Status: No status
Milestone
v1.34
Development

Successfully merging this pull request may close these issues.

Pod probes lead to blind SSRF from the node
6 participants
@tssurya @k8s-ci-robot @ibihim @k8s-triage-robot @deads2k @liggitt