{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/70095","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/70095/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/70095/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/70095/events","html_url":"https://github.com/kubernetes/kubernetes/issues/70095","id":372638134,"node_id":"MDU6SXNzdWUzNzI2MzgxMzQ=","number":70095,"title":"Group binding `system:serviceaccounts:kube-system` binds to all serviceaccounts clusterwide","user":{"login":"surajssd","id":5815795,"node_id":"MDQ6VXNlcjU4MTU3OTU=","avatar_url":"https://avatars0.githubusercontent.com/u/5815795?v=4","gravatar_id":"","url":"https://api.github.com/users/surajssd","html_url":"https://github.com/surajssd","followers_url":"https://api.github.com/users/surajssd/followers","following_url":"https://api.github.com/users/surajssd/following{/other_user}","gists_url":"https://api.github.com/users/surajssd/gists{/gist_id}","starred_url":"https://api.github.com/users/surajssd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/surajssd/subscriptions","organizations_url":"https://api.github.com/users/surajssd/orgs","repos_url":"https://api.github.com/users/surajssd/repos","events_url":"https://api.github.com/users/surajssd/events{/privacy}","received_events_url":"https://api.github.com/users/surajssd/received_events","type":"User","site_admin":false},"labels":[{"id":105146071,"node_id":"MDU6TGFiZWwxMDUxNDYwNzE=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/bug","name":"kind/bug","color":"e11d21","default":false},{"id":617149945,"node_id":"MDU6TGFiZWw2MTcxNDk5NDU=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-sig","name":"needs-sig","color":"ededed","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-10-22T18:21:03Z","updated_at":"2018-10-22T20:04:30Z","closed_at":null,"author_association":"MEMBER","body":"**Is this a BUG REPORT or FEATURE REQUEST?**:\r\n\r\n/kind bug\r\n\r\n**What happened**:\r\n\r\nI am creating a ClusterRoleBinding which binds to all the namespaces across cluster.\r\n\r\n\r\n**What you expected to happen**:\r\n\r\nIt should only bind to ServiceAccount in `kube-system` namespace.\r\n\r\n**How to reproduce it (as minimally and precisely as possible)**:\r\n\r\n- Start cluster with admission plugin `PodSecurityPolicy`\r\n\r\n- Create user\r\n\r\nI have created an user certs following the blog: https://brancz.com/2017/10/16/kubernetes-auth-x509-client-certificates/\r\n\r\nThe user has following permissions:\r\n\r\n```yaml\r\napiVersion: rbac.authorization.k8s.io/v1beta1\r\nkind: ClusterRole\r\nmetadata:\r\n  name: normal-user\r\nrules:\r\n- apiGroups:\r\n  - \"\"\r\n  - \"apps\"\r\n  - \"extensions\"\r\n  resources:\r\n  - pods\r\n  - namespaces\r\n  - deployments\r\n  verbs:\r\n  - \"*\"\r\n---\r\napiVersion: rbac.authorization.k8s.io/v1beta1\r\nkind: ClusterRoleBinding\r\nmetadata:\r\n  name: normal-users\r\nroleRef:\r\n  apiGroup: rbac.authorization.k8s.io\r\n  kind: ClusterRole\r\n  name: normal-user\r\nsubjects:\r\n- apiGroup: rbac.authorization.k8s.io\r\n  kind: User\r\n  # this is my user name\r\n  name: suraj\r\n```\r\n\r\n- Create a PodSecurityPolicy and corresponding ClusterRole and ClusterRoleBinding\r\n\r\n```yaml\r\napiVersion: policy/v1beta1\r\nkind: PodSecurityPolicy\r\nmetadata:\r\n  name: privileged\r\n  annotations:\r\n    seccomp.security.alpha.kubernetes.io/allowedProfileNames: '*'\r\nspec:\r\n  privileged: true\r\n  allowPrivilegeEscalation: true\r\n  allowedCapabilities:\r\n  - '*'\r\n  volumes:\r\n  - '*'\r\n  hostNetwork: true\r\n  hostPorts:\r\n  - min: 0\r\n    max: 65535\r\n  hostIPC: true\r\n  hostPID: true\r\n  runAsUser:\r\n    rule: 'RunAsAny'\r\n  seLinux:\r\n    rule: 'RunAsAny'\r\n  supplementalGroups:\r\n    rule: 'RunAsAny'\r\n  fsGroup:\r\n    rule: 'RunAsAny'\r\n---\r\nkind: ClusterRole\r\napiVersion: rbac.authorization.k8s.io/v1\r\nmetadata:\r\n  name: privileged-psp\r\nrules:\r\n- apiGroups: ['policy']\r\n  resources: ['podsecuritypolicies']\r\n  verbs:     ['use']\r\n  resourceNames:\r\n  - privileged\r\n---\r\nkind: ClusterRoleBinding\r\napiVersion: rbac.authorization.k8s.io/v1\r\nmetadata:\r\n  name: privileged-psp-cluster-admins\r\nroleRef:\r\n  kind: ClusterRole\r\n  name: privileged-psp\r\n  apiGroup: rbac.authorization.k8s.io\r\nsubjects:\r\n- kind: Group\r\n  name: system:serviceaccount:kube-system\r\n  apiGroup: rbac.authorization.k8s.io\r\n```\r\n\r\nIn above example see that the PSP is bound to group `system:serviceaccount:kube-system` which means that the ServiceAccounts in `kube-system` namespace will get bound to the PSP defined above.\r\n\r\n- Test this by running pods\r\n\r\n```bash\r\n$ kubectl --kubeconfig kubeconfig create ns psp-testing\r\nnamespace/psp-testing created\r\n\r\n$ kubectl --kubeconfig kubeconfig -n psp-testing run web --image httpd\r\nkubectl run --generator=deployment/apps.v1beta1 is DEPRECATED and will be removed in a future version. Use kubectl create instead.\r\ndeployment.apps/web created\r\n\r\n$ kubectl --kubeconfig kubeconfig -n psp-testing get deployment web -o jsonpath='{.status.conditions[-1:].message}'\r\npods \"web-7998c657dd-\" is forbidden: no providers available to validate pod request\r\n```\r\n\r\nThis failed as expected.\r\n\r\n- Update the ClusterRoleBinding by changing the Group name to `system:serviceaccounts:kube-system`, added a `s` to `serviceaccount`.\r\n\r\n```yaml\r\necho \"\r\nkind: ClusterRoleBinding\r\napiVersion: rbac.authorization.k8s.io/v1\r\nmetadata:\r\n  name: privileged-psp-cluster-admins\r\nroleRef:\r\n  kind: ClusterRole\r\n  name: privileged-psp\r\n  apiGroup: rbac.authorization.k8s.io\r\nsubjects:\r\n- kind: Group\r\n  name: system:serviceaccounts:kube-system\r\n  apiGroup: rbac.authorization.k8s.io\r\n\" | kubectl apply -f -\r\n```\r\n\r\nThis permission spills over to other namespaces.\r\n\r\n- Try to run the pods\r\n\r\n```bash\r\n$ kubectl --kubeconfig kubeconfig create ns psp-testing2\r\nnamespace/psp-testing2 created\r\n\r\n$ kubectl --kubeconfig kubeconfig -n psp-testing2 run web --image httpd\r\nkubectl run --generator=deployment/apps.v1beta1 is DEPRECATED and will be removed in a future version. Use kubectl create instead.                                                                                                    \r\ndeployment.apps/web created\r\n\r\n$ kubectl --kubeconfig kubeconfig -n psp-testing2 get pods\r\nNAME                   READY   STATUS              RESTARTS   AGE\r\nweb-7998c657dd-rd9gk   0/1     ContainerCreating   0          2s\r\n```\r\n\r\n**The above pod should not have started but it did. Which means that the permission got spilled.**\r\n\r\n- If you want to re-create this setup in a single script then run this https://gist.github.com/surajssd/49366480c7c82eafef810ed598542a7f, make sure you have user created and permissions given to user as above and the cluster has admission controller `PodSecurityPolicy` enabled.\r\n\r\n**Environment**:\r\n- Kubernetes version:\r\n\r\n```yaml\r\n$ kubectl version -o yaml\r\nclientVersion:\r\n  buildDate: 2018-10-05T16:46:06Z\r\n  compiler: gc\r\n  gitCommit: 4ed3216f3ec431b140b1d899130a69fc671678f4\r\n  gitTreeState: clean\r\n  gitVersion: v1.12.1\r\n  goVersion: go1.10.4\r\n  major: \"1\"\r\n  minor: \"12\"\r\n  platform: linux/amd64\r\nserverVersion:\r\n  buildDate: 2018-10-05T16:36:14Z\r\n  compiler: gc\r\n  gitCommit: 4ed3216f3ec431b140b1d899130a69fc671678f4\r\n  gitTreeState: clean\r\n  gitVersion: v1.12.1\r\n  goVersion: go1.10.4\r\n  major: \"1\"\r\n  minor: \"12\"\r\n  platform: linux/amd64\r\n```\r\n\r\n- Install tools:\r\n\r\n```bash\r\n$ minikube version\r\nminikube version: v0.30.0\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/431963065","html_url":"https://github.com/kubernetes/kubernetes/issues/70095#issuecomment-431963065","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/70095","id":431963065,"node_id":"MDEyOklzc3VlQ29tbWVudDQzMTk2MzA2NQ==","user":{"login":"k8s-ci-robot","id":20407524,"node_id":"MDQ6VXNlcjIwNDA3NTI0","avatar_url":"https://avatars0.githubusercontent.com/u/20407524?v=4","gravatar_id":"","url":"https://api.github.com/users/k8s-ci-robot","html_url":"https://github.com/k8s-ci-robot","followers_url":"https://api.github.com/users/k8s-ci-robot/followers","following_url":"https://api.github.com/users/k8s-ci-robot/following{/other_user}","gists_url":"https://api.github.com/users/k8s-ci-robot/gists{/gist_id}","starred_url":"https://api.github.com/users/k8s-ci-robot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/k8s-ci-robot/subscriptions","organizations_url":"https://api.github.com/users/k8s-ci-robot/orgs","repos_url":"https://api.github.com/users/k8s-ci-robot/repos","events_url":"https://api.github.com/users/k8s-ci-robot/events{/privacy}","received_events_url":"https://api.github.com/users/k8s-ci-robot/received_events","type":"User","site_admin":false},"created_at":"2018-10-22T20:04:30Z","updated_at":"2018-10-22T20:04:30Z","author_association":"CONTRIBUTOR","body":"@surajssd: There are no sig labels on this issue. Please add a sig label by either:\n\n1. mentioning a sig: `@kubernetes/sig-<group-name>-<group-suffix>`\n    e.g., `@kubernetes/sig-contributor-experience-<group-suffix>` to notify the contributor experience sig, OR\n\n2. specifying the label manually: `/sig <group-name>`\n    e.g., `/sig scalability` to apply the `sig/scalability` label\n\nNote: Method 1 will trigger an email to the group. See the [group list](https://git.k8s.io/community/sig-list.md).\nThe `<group-suffix>` in method 1 has to be replaced with one of these: _**bugs, feature-requests, pr-reviews, test-failures, proposals**_.\n\n\n<details>\n\nInstructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository.\n</details>"}}
{"actor":{"display_login":"k8s-ci-robot"}}