{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kops/issues/1479","repository_url":"https://api.github.com/repos/kubernetes/kops","labels_url":"https://api.github.com/repos/kubernetes/kops/issues/1479/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kops/issues/1479/comments","events_url":"https://api.github.com/repos/kubernetes/kops/issues/1479/events","html_url":"https://github.com/kubernetes/kops/issues/1479","id":200891350,"number":1479,"title":"Security: any pod can grant itself cluster-admin privileges.","user":{"login":"abourget","id":93424,"avatar_url":"https://avatars2.githubusercontent.com/u/93424?v=4","gravatar_id":"","url":"https://api.github.com/users/abourget","html_url":"https://github.com/abourget","followers_url":"https://api.github.com/users/abourget/followers","following_url":"https://api.github.com/users/abourget/following{/other_user}","gists_url":"https://api.github.com/users/abourget/gists{/gist_id}","starred_url":"https://api.github.com/users/abourget/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/abourget/subscriptions","organizations_url":"https://api.github.com/users/abourget/orgs","repos_url":"https://api.github.com/users/abourget/repos","events_url":"https://api.github.com/users/abourget/events{/privacy}","received_events_url":"https://api.github.com/users/abourget/received_events","type":"User","site_admin":false},"labels":[{"id":469777242,"url":"https://api.github.com/repos/kubernetes/kops/labels/area/security","name":"area/security","color":"c5def5","default":false},{"id":778139396,"url":"https://api.github.com/repos/kubernetes/kops/labels/lifecycle/rotten","name":"lifecycle/rotten","color":"604460","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/kops/milestones/3","html_url":"https://github.com/kubernetes/kops/milestone/3","labels_url":"https://api.github.com/repos/kubernetes/kops/milestones/3/labels","id":1919771,"number":3,"title":"backlog","description":"Issues in the backlog aren't targeted for a particular release, but if a PR comes in it will be very welcome.","creator":{"login":"justinsb","id":100893,"avatar_url":"https://avatars2.githubusercontent.com/u/100893?v=4","gravatar_id":"","url":"https://api.github.com/users/justinsb","html_url":"https://github.com/justinsb","followers_url":"https://api.github.com/users/justinsb/followers","following_url":"https://api.github.com/users/justinsb/following{/other_user}","gists_url":"https://api.github.com/users/justinsb/gists{/gist_id}","starred_url":"https://api.github.com/users/justinsb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justinsb/subscriptions","organizations_url":"https://api.github.com/users/justinsb/orgs","repos_url":"https://api.github.com/users/justinsb/repos","events_url":"https://api.github.com/users/justinsb/events{/privacy}","received_events_url":"https://api.github.com/users/justinsb/received_events","type":"User","site_admin":false},"open_issues":65,"closed_issues":125,"state":"open","created_at":"2016-08-03T03:09:45Z","updated_at":"2018-02-21T04:52:56Z","due_on":null,"closed_at":null},"comments":4,"created_at":"2017-01-15T20:14:29Z","updated_at":"2018-02-21T17:01:06Z","closed_at":null,"author_association":"NONE","body":"In a kops cluster, any pod can `s3cmd --no-check-certificate get s3://your-state-store/your-cluster.k8s.your.domain.example.com/pki/private/ca/23456789.....key`, and sign itself a cluster admin keypair.\r\n\r\nI find this to be a pretty high risk security issue. It defeats most of the security measures put in place, like RBAC and such, since escalation to cluster-admin is literally 2 well-known commands away.\r\n\r\nRef: https://github.com/kubernetes/kops/issues/363"},"comment":{"url":"https://api.github.com/repos/kubernetes/kops/issues/comments/367395832","html_url":"https://github.com/kubernetes/kops/issues/1479#issuecomment-367395832","issue_url":"https://api.github.com/repos/kubernetes/kops/issues/1479","id":367395832,"user":{"login":"fejta-bot","id":30488982,"avatar_url":"https://avatars1.githubusercontent.com/u/30488982?v=4","gravatar_id":"","url":"https://api.github.com/users/fejta-bot","html_url":"https://github.com/fejta-bot","followers_url":"https://api.github.com/users/fejta-bot/followers","following_url":"https://api.github.com/users/fejta-bot/following{/other_user}","gists_url":"https://api.github.com/users/fejta-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/fejta-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fejta-bot/subscriptions","organizations_url":"https://api.github.com/users/fejta-bot/orgs","repos_url":"https://api.github.com/users/fejta-bot/repos","events_url":"https://api.github.com/users/fejta-bot/events{/privacy}","received_events_url":"https://api.github.com/users/fejta-bot/received_events","type":"User","site_admin":false},"created_at":"2018-02-21T17:01:06Z","updated_at":"2018-02-21T17:01:06Z","author_association":"NONE","body":"Rotten issues close after 30d of inactivity.\nReopen the issue with `/reopen`.\nMark the issue as fresh with `/remove-lifecycle rotten`.\n\nSend feedback to sig-testing, kubernetes/test-infra and/or [fejta](https://github.com/fejta).\n/close"}}
{"actor":{"display_login":"fejta-bot"}}