<p>I'm creating an agent service that accepts network calls and can trigger commands in any other container in the same pod. This, of course, isn't the usual use case of pods, but I know some CI tools do something similar, such as Jenkins and it's Kubernetes plugin.</p>
<p>Currently, I have it working using kubectl in the agent container and have it running <code>kubectl exec &lt;pod&gt; -c &lt;container&gt; -- &lt;command&gt;</code> and it works fine. But it seems like a big opportunity for vulnerabilities.</p>
<p>In order for the agent to have kubectl exec access, it needs to have privilege on <code>pod/exec</code> which gives it access to all pods in the same namespace.</p>
<pre class="lang-yaml prettyprint-override"><code>rules:
- apiGroups: [&quot;&quot;]
  resources: [&quot;pods&quot;, &quot;pods/exec&quot;]
  verbs: [&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;create&quot;]
</code></pre>
<p>If there aren't any better ways to approach this, I'll just bake the exec commands into my agent in such a way that it'll only accept calls to the same pod.</p>
<p>But my big concern is around executing unknown code from the agent and it getting access to more than it should. In the Jenkins example, if someone has a pipeline that tests their code and they were malicious and included a test which actually uses the kubernetes-client library and calls out to the other pods in the namespace, how would you prevent that while still enabling the container to container communication?</p>
<p>I'd appreciate any suggestions!</p>

<p>Sounds like you want to execute commands in the pod but you don't want to hit the kube-apiserver. Also, looks like your application is listening for a trigger (on some sort of even based broker or application) and executing the command.</p>
<p>My suggestion would be to just have the application <a href="https://stackoverflow.com/questions/28628985/what-does-shell-out-or-shelling-out-mean">'shell out'</a> run the command itself instead of just having <em><code>kubectl</code></em> run it on the same pod with <em><code>exec</code></em>. You didn't specify what language your application is written in but most common languages have a library to do an exec system call or manage processes. i.e <a href="https://golang.org/pkg/os/exec/" rel="nofollow noreferrer">Golang</a>, <a href="https://docs.python.org/2/library/os.html" rel="nofollow noreferrer">Python</a>, etc.</p>
<p>✌️</p>
