3 ms·

Patch for critical privilege escalation flaw in Kubernetes

54 points by rapathak 8y ago

merb 8y ago
hm, so only people are affected that gave users access to specific permissions that are not supposed to do everything. we only allow cluster access to people that needed cluster-admin rights anyway.. for anybody else, we abstract k8s away.
- web007 8y ago
  https://github.com/kubernetes/kubernetes/issues/71411 https://github.com/kubernetes/kubernetes/issues/71411 for more details, which includes: In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation.
coleca 8y ago
Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago. The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.
- zegl 8y ago
  Kubernetes has a hard time defining itself sometimes, this behavior makes sense if you think of Kubernetes as a kernel. You either run directly on the kernel, or use a OS that adds features and LTS support to it. I know however that there is a LTS-SIG that’s trying to figure out what Kubernetes is, and for how long old releases should be supported.
- segmondy 8y ago
  Yeah, that's a bit worrying, k8s needs to take security very seriously. if your k8s cluster get's compromised, it's all your machines & apps getting compromised at the exact time. This is worse than a typical remote exploit that might give access to one server or app.
- andrewstuart2 8y ago
  If you're using something like kops or kubeadm, chances are you're on the latest anyway and updating will take you all of an hour and zero downtime. The Kubernetes project is pretty explicit about only supporting 3 minor versions back, which gives you a full 3 quarters to figure out if the changes break anything you have deployed and fix those cases. If that's too fast, you're probably an Enterprise anyway and uncomfortable with anything but vendor support.
- gaius 8y ago
  1.09 was released just a year ago. Quite normal in this space, see Docker for example.
bostonvaulter2 8y ago
I don't really understand the fix: https://github.com/kubernetes/kubernetes/pull/71412/files https://github.com/kubernetes/kubernetes/pull/71412/files I was expecting something that altered more rather than a bunch of length checks. But I guess that's how security is sometimes.

54 points by rapathak 8y ago

merb 8y ago

hm, so only people are affected that gave users access to specific permissions that are not supposed to do everything. we only allow cluster access to people that needed cluster-admin rights anyway.. for anybody else, we abstract k8s away.

web007 8y ago
https://github.com/kubernetes/kubernetes/issues/71411 https://github.com/kubernetes/kubernetes/issues/71411 for more details, which includes: In default configurations, all users (authenticated and unauthenticated) are allowed to perform discovery API calls that allow this escalation.

coleca 8y ago

Shame they aren't updating anything older than 1.10. 1.09 was released just a year ago. The commercial K8S vendors seem to be doing the patch all the way back. Smart move by them to signal to the enterprise the value of using a commercially supported K8S distribution over something like kops or kubeadm.

zegl 8y ago
Kubernetes has a hard time defining itself sometimes, this behavior makes sense if you think of Kubernetes as a kernel. You either run directly on the kernel, or use a OS that adds features and LTS support to it. I know however that there is a LTS-SIG that’s trying to figure out what Kubernetes is, and for how long old releases should be supported.
segmondy 8y ago
Yeah, that's a bit worrying, k8s needs to take security very seriously. if your k8s cluster get's compromised, it's all your machines & apps getting compromised at the exact time. This is worse than a typical remote exploit that might give access to one server or app.
andrewstuart2 8y ago
If you're using something like kops or kubeadm, chances are you're on the latest anyway and updating will take you all of an hour and zero downtime. The Kubernetes project is pretty explicit about only supporting 3 minor versions back, which gives you a full 3 quarters to figure out if the changes break anything you have deployed and fix those cases. If that's too fast, you're probably an Enterprise anyway and uncomfortable with anything but vendor support.
gaius 8y ago
1.09 was released just a year ago. Quite normal in this space, see Docker for example.

bostonvaulter2 8y ago

I don't really understand the fix: https://github.com/kubernetes/kubernetes/pull/71412/files https://github.com/kubernetes/kubernetes/pull/71412/files I was expecting something that altered more rather than a bunch of length checks. But I guess that's how security is sometimes.