jakman85andClaude Opus 5
ab9ba32a76
Closes half of the admission gap a sibling agent found in PR #13's policy: it pins the MAIN container's `command` but never reads `initContainers`, so a Job from `conformance-trigger` can carry an init container with `command: ["/bin/sh","-c"]` and an arbitrary script, running as the privileged `conformance-runner` SA. Reproduced by the policy's author: pass 3, fail 0 on a privileged alpine:latest init container running `kubectl get secrets -A`. The image now carries /usr/local/bin/conformance-clone, 0755 root:root, so uid 65532 cannot replace the one executable the policy will come to trust. Clone logic taken from PR #20's `clone-suite-at-commit`, with both load-bearing properties preserved: the SHA must match ^[0-9a-f]{40}$, and `rev-parse HEAD` is ASSERTED equal to it after checkout, so an unrendered placeholder is a hard failure instead of a silent run of the branch tip. No arguments are accepted. DEVIATION FROM THE BRIEF, DELIBERATE: the repo URL and clone target are COMPILED IN rather than read from the environment. I was asked to take SHA, repo URL and target dir from env. The policy contains no `env`/`valueFrom`/`secretKeyRef` clause at all -- so trusting CONFORMANCE_REPO_URL would move the injection one field over: the trigger points it at a repo it controls, this fetches that, and ./run.sh from the attacker's tree runs under the privileged SA. "No args" would not have stopped it. The env vars are still read so the Job template stays self-documenting, but a value disagreeing with the baked literal is a hard failure, never a redirect. The SHA is the only genuinely trusted per-run input. THIS IS HALF A FIX. What makes the fixed path REQUIRED rather than merely available is a 4th policy rule demanding command: ["/usr/local/bin/conformance-clone"] with no args on every initContainer. That edits the security boundary and belongs in its own reviewed PR -- it is NOT here. Until it lands the hole is open, and the README, the Containerfile and the script header all say so. VERIFIED by running it (uid 65532, --read-only): root:root 755 and confirmed not writable by the runner; seven negative cases each asserted to exit non-zero (arguments, missing SHA, a branch name, an unrendered @@placeholder@@, HOME off the workspace volume, a REDIRECTED repo URL, a clone target off the workspace volume); and the positive case -- a real clone of this repo at a real 40-hex SHA with rev-parse HEAD proven equal to it. Two bugs of mine that only running it could find, both fixed: the workspace-path guard matched /workspace/* and so rejected the image's own HOME=/workspace; and the negative checks were pipelines, which under pipefail aborted the verify at the first expected failure and silently skipped the other six. A verify that stops early looks exactly like a verify that passed. The anonymous-clone fallback is deliberate and logged: read access to this repo needs no credential today, the integrity guarantee is the SHA assertion rather than the credential, and requiring the Secret would make the script untestable without one. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
74 lines
4.6 KiB
Bash
74 lines
4.6 KiB
Bash
# Pinned tool versions for the conformance harness (R-TEST-02: deterministic).
|
|
# The harness is only reproducible if the toolchain is pinned. Bumps flow through the
|
|
# normal update path (ADR-0011) with the suite re-green as the gate — never bumped
|
|
# silently. `run.sh` sources this file; the in-cluster Chainsaw Job image (see
|
|
# incluster/chainsaw-job.yaml) MUST use the same CHAINSAW_VERSION.
|
|
|
|
# Chainsaw — L1 rendering / L2 behavioral / L3 fault-injection runner (ADR-0011).
|
|
CHAINSAW_VERSION="v0.2.12"
|
|
# The UPSTREAM chainsaw image. It is NOT what the in-cluster Job runs — see
|
|
# CONFORMANCE_RUNNER_IMAGE below. It carries the chainsaw binary and essentially nothing
|
|
# else (no bash, no python3, no kubectl, no git), so `command: ["./run.sh"]` on this image
|
|
# fails at exec. Kept only as the provenance of the chainsaw binary we rebuild from.
|
|
CHAINSAW_IMAGE="ghcr.io/kyverno/chainsaw:v0.2.12"
|
|
|
|
# kubectl — used by run.sh for cluster reachability preflight and by probe scripts.
|
|
KUBECTL_VERSION="v1.36.4"
|
|
|
|
# Kyverno CLI — L0 static/policy gate (owned by T-0.5, referenced here for a single
|
|
# pinned toolchain view). Not invoked by run.sh yet.
|
|
KYVERNO_VERSION="v1.19.0"
|
|
|
|
# Python 3 — coverage generator + JUnit emitter use stdlib only (no pip deps), so the
|
|
# only constraint is a modern interpreter.
|
|
PYTHON_MIN="3.9"
|
|
|
|
# --- In-cluster conformance runner image -------------------------------------
|
|
# Built from conformance/incluster/Containerfile by conformance/incluster/build-image.sh.
|
|
# This — not CHAINSAW_IMAGE — is what the L2/L3 Job runs (bash + python3 + chainsaw +
|
|
# kubectl + git). Closes docs/plans/l2-l3-conformance-ci-wiring.md §3 item 1.
|
|
#
|
|
# It ALSO carries /usr/local/bin/conformance-clone (0755 root:root, no argument surface) as the
|
|
# init container's only entrypoint. That is a security fixture, not a convenience: the
|
|
# admission policy never reads `initContainers`, so an init container with an inline shell
|
|
# script is currently admitted with the privileged runner SA. The policy rule that makes the
|
|
# fixed path REQUIRED is not in this branch — see conformance/incluster/README.md.
|
|
#
|
|
# THE REPOSITORY PATH IS NOT A PREFERENCE. platform/kyverno/admission/
|
|
# conformance-trigger-job-shape.yaml is a fail-closed Enforce ClusterPolicy (R-SEC-02) that
|
|
# ADMITS a conformance-trigger Job only when its image matches
|
|
# gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:*
|
|
# Any other path, and any TAG reference, is DENIED at admission. Do not "tidy" these values.
|
|
CONFORMANCE_RUNNER_IMAGE_REPO="gitea.home.keithjackson.dev/home-network/conformance-runner"
|
|
# Build handle only. Admission never sees the tag; a Job must reference the digest.
|
|
CONFORMANCE_RUNNER_IMAGE_TAG="chainsaw0.2.12-kubectl1.36.4-fc44"
|
|
#
|
|
# ############################################################################
|
|
# # DIGEST DELIBERATELY EMPTY — THE IMAGE HAS NOT BEEN PUBLISHED YET. #
|
|
# ############################################################################
|
|
# The image has been BUILT and its toolchain verified locally (non-root uid 65532,
|
|
# read-only rootfs: bash 5.3.9, Python 3.14.7, git 2.55.0, kubectl v1.36.4, chainsaw 0.2.12,
|
|
# and `./run.sh --layer l2 --no-cluster` completing with rc 0). It has NOT been pushed:
|
|
# pushing needs a registry credential, and publishing the artifact a fail-closed security
|
|
# boundary then trusts is an OPERATOR action, not an agent's.
|
|
#
|
|
# OPERATOR, to complete the pin:
|
|
# 1. ./conformance/incluster/build-image.sh # rebuild, verify, print the commands
|
|
# 2. podman login gitea.home.keithjackson.dev
|
|
# 3. podman push --digestfile /tmp/conformance-runner.digest \
|
|
# "${CONFORMANCE_RUNNER_IMAGE_REPO}:${CONFORMANCE_RUNNER_IMAGE_TAG}"
|
|
# 4. Set CONFORMANCE_RUNNER_IMAGE_DIGEST below to `cat /tmp/conformance-runner.digest`
|
|
# — the digest the REGISTRY returned, not the local manifest digest the build printed.
|
|
# 5. Land steps 4 in a PR (this file is GitOps input, not a live edit).
|
|
#
|
|
# UNTIL THEN: this is empty on purpose, NOT a placeholder to be guessed at. An empty value
|
|
# makes any consumer that renders the Job fail visibly; a fake or stale digest would instead
|
|
# produce an ImagePullBackOff that looks like a cluster fault. Do not invent one.
|
|
CONFORMANCE_RUNNER_IMAGE_DIGEST=""
|
|
CONFORMANCE_RUNNER_IMAGE="${CONFORMANCE_RUNNER_IMAGE_DIGEST:+${CONFORMANCE_RUNNER_IMAGE_REPO}@${CONFORMANCE_RUNNER_IMAGE_DIGEST}}"
|
|
#
|
|
# AFTERWARDS, TIGHTEN THE BOUNDARY: the header of conformance-trigger-job-shape.yaml asks for
|
|
# its `@sha256:*` wildcard to be replaced with the LITERAL digest once the image exists —
|
|
# that closes the residual "anyone who can push to this path" gap. Separate PR, human
|
|
# reviewed, because it edits the security boundary itself.
|