Skip to content

Commit

Permalink
Write pod-manifests as 0600 in cis mode (#4840)
Browse files Browse the repository at this point in the history
* Write pod-manifests as 0600 in cis mode

Signed-off-by: Derek Nola <[email protected]>
  • Loading branch information
dereknola authored Oct 5, 2023
1 parent a9413c2 commit 7043294
Show file tree
Hide file tree
Showing 3 changed files with 19 additions and 3 deletions.
6 changes: 6 additions & 0 deletions pkg/podexecutor/staticpod.go
Original file line number Diff line number Diff line change
Expand Up @@ -214,6 +214,7 @@ func (s *StaticPodConfig) KubeProxy(_ context.Context, args []string) error {
Command: "kube-proxy",
Args: args,
Image: image,
CISMode: s.CISMode,
HealthPort: 10256,
HealthProto: "HTTP",
CPURequest: s.ControlPlaneResources.KubeProxyCPURequest,
Expand Down Expand Up @@ -315,6 +316,7 @@ func (s *StaticPodConfig) APIServer(_ context.Context, etcdReady <-chan struct{}
Args: args,
Image: image,
Dirs: dirs,
CISMode: s.CISMode,
CPURequest: s.ControlPlaneResources.KubeAPIServerCPURequest,
CPULimit: s.ControlPlaneResources.KubeAPIServerCPULimit,
MemoryRequest: s.ControlPlaneResources.KubeAPIServerMemoryRequest,
Expand Down Expand Up @@ -367,6 +369,7 @@ func (s *StaticPodConfig) Scheduler(_ context.Context, apiReady <-chan struct{},
Command: "kube-scheduler",
Args: args,
Image: image,
CISMode: s.CISMode,
HealthPort: 10259,
HealthProto: "HTTPS",
CPURequest: s.ControlPlaneResources.KubeSchedulerCPURequest,
Expand Down Expand Up @@ -436,6 +439,7 @@ func (s *StaticPodConfig) ControllerManager(_ context.Context, apiReady <-chan s
Args: args,
Image: image,
Dirs: onlyExisting(ssldirs),
CISMode: s.CISMode,
HealthPort: 10257,
HealthProto: "HTTPS",
CPURequest: s.ControlPlaneResources.KubeControllerManagerCPURequest,
Expand Down Expand Up @@ -466,6 +470,7 @@ func (s *StaticPodConfig) CloudControllerManager(_ context.Context, ccmRBACReady
Args: args,
Image: image,
Dirs: onlyExisting(ssldirs),
CISMode: s.CISMode,
HealthPort: 10258,
HealthProto: "HTTPS",
CPURequest: s.ControlPlaneResources.CloudControllerManagerCPURequest,
Expand Down Expand Up @@ -539,6 +544,7 @@ func (s *StaticPodConfig) ETCD(ctx context.Context, args executor.ETCDConfig, ex
args.PeerTrust.KeyFile,
args.PeerTrust.TrustedCAFile,
},
CISMode: s.CISMode,
HealthPort: 2381,
HealthPath: "/health?serializable=true",
HealthProto: "HTTP",
Expand Down
11 changes: 8 additions & 3 deletions pkg/staticpod/staticpod.go
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"encoding/hex"
"fmt"
"io"
"io/fs"
"io/ioutil"
"os"
"path/filepath"
Expand Down Expand Up @@ -50,6 +51,7 @@ type Args struct {
Image name.Reference
Dirs []string
Files []string
CISMode bool // CIS requires that the manifest be saved with 600 permissions
ExcludeFiles []string
HealthExec []string
HealthPort int32
Expand Down Expand Up @@ -123,10 +125,13 @@ func Run(dir string, args Args) error {
if err != nil {
return err
}
return writeFile(manifestPath, b)
if args.CISMode {
return writeFile(manifestPath, b, 0600)
}
return writeFile(manifestPath, b, 0644)
}

func writeFile(dest string, content []byte) error {
func writeFile(dest string, content []byte, perm fs.FileMode) error {
name := filepath.Base(dest)
dir := filepath.Dir(dest)
if err := os.MkdirAll(dir, 0700); err != nil {
Expand All @@ -149,7 +154,7 @@ func writeFile(dest string, content []byte) error {
defer os.RemoveAll(tmpdir)

tmp := filepath.Join(tmpdir, name)
if err := ioutil.WriteFile(tmp, content, 0644); err != nil {
if err := os.WriteFile(tmp, content, perm); err != nil {
return err
}
return os.Rename(tmp, dest)
Expand Down
5 changes: 5 additions & 0 deletions tests/e2e/vagrantdefaults.rb
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,9 @@ def getInstallType(vm, version, branch)
scripts_location = Dir.exists?("./scripts") ? "./scripts" : "../scripts"
vm.provision "shell", path: scripts_location + "/latest_commit.sh", args: [branch, "/tmp/rke2_commits"]
return "INSTALL_RKE2_COMMIT=$(head\ -n\ 1\ /tmp/rke2_commits)"
end

def cisPrep(vm)
vm.provision "shell", inline: "useradd -r -c 'etcd user' -s /sbin/nologin -M etcd -U"
vm.provision "shell", inline: "printf 'vm.panic_on_oom=0\nvm.overcommit_memory=1\nkernel.panic=10\nkernel.panic_on_oops=1' > /etc/sysctl.d/60-rke2-cis.conf; systemctl restart systemd-sysctl"
end

0 comments on commit 7043294

Please sign in to comment.