Skip to content

Commit 68fc805

Browse files
committed
address pr comments
1 parent 0db4133 commit 68fc805

File tree

1 file changed

+198
-79
lines changed

1 file changed

+198
-79
lines changed

keps/sig-cli/kustomize-exec-secret-generator.md

Lines changed: 198 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -35,33 +35,33 @@ status: implementable
3535
## Summary
3636

3737
The ability to generate Secrets using `exec` was removed in kustomize v2 because of security concerns
38-
about allowing `kustomization.yaml`'s publishers to execute arbitrary commands on the
39-
machines of any user who applies the `kustomization.yaml`.
38+
about users kustomizing malicious `kustomization.yaml`s and thereby providing a path for `kustomization.yaml`'s
39+
publishers to execute arbitrary commands on the machines of any user who applies the `kustomization.yaml`.
4040

4141
Example goal to enable:
4242

43-
- Alice wants to develop an Application requiring a shared Secret, and to deploy it on Kubernetes using gitops
44-
- Alice wants her gitops deployment mechanism to pull the Secrets that it deploys from an
43+
- Alice wants to develop an Application requiring a shared Secret, and to deploy it on Kubernetes using GitOps
44+
- Alice wants her GitOps deployment mechanism to pull the Secrets that it deploys from an
4545
remote source without writing the Secrets as files to local disk.
46-
- Alice's organization configures the gitops deployment container to run kustomize in the cluster
46+
- Alice's organization configures the gitops deployment container to run Kustomize in the cluster
4747
and be capable of pulling Secrets from remote locations
4848
- Alice writes her kustomization.yaml to use the generation options configured by her organization.
4949

5050
Example exploit to avoid:
5151

5252
- Alice wants to run a whitebox mysql instance on a test cluster
53-
- Carl publishes a whitebox mysql `kustomization.yaml` on GitHub, with a SecretGenerator
54-
that will read Alice's ~/.kube/config and send it to Carl's server by executing `sh`
55-
will a script to generate some Secret
56-
- Alice runs `kubectl apply -k https://github.com/carl/mysql` and has the credentials
57-
of all of her Kubernetes clusters sent to Carl when the Secret is generated.
53+
- Chuck publishes a whitebox mysql `kustomization.yaml` on GitHub, with a SecretGenerator
54+
that will read Alice's ~/.kube/config and send it to Chuck's server by executing `sh`
55+
will run a script to generate some Secret
56+
- Alice runs `kubectl apply -k https://github.com/chuck/mysql` and has the credentials
57+
of all of her Kubernetes clusters sent to Chuck when the Secret is generated.
5858

59-
See [692][execRemoval] for more details.
59+
See [kubernetes-sigs/kustomize#692](https://github.com/kubernetes-sigs/kustomize/issues/692) for more details.
6060

6161
## Motivation
6262

63-
The ability to create Kubernetes Secrets generated by commands is a commonly requested user.
64-
This is useful for use cases where the user doesn't want the Secrets to be appear decrypted
63+
The ability to create Kubernetes Secrets generated by commands is commonly requested by users.
64+
This is useful for use cases where the user does not want the Secrets to be appear decrypted
6565
on disk before being applied to the cluster.
6666

6767
Examples:
@@ -70,89 +70,197 @@ Examples:
7070
- Secrets sources are not stored locally, and need to be fetched from some remote location
7171
- Secrets are generated using some function (e.g. private-keys)
7272

73-
**Note:** For the common targeted case, *the solution for generating the Secret already
74-
exists as a command on the user's machine*. User's are not expected to require a
75-
marketplace of solutions, rather instead they are expected to need to be able to
76-
invoke the tools they already depend upon.
73+
**Note:** For the target case, *the command for generating the Secret already exists as an executable on
74+
the user's machine*. User's are not expected to want a marketplace of solutions, rather instead they are
75+
expected to want to be able to invoke the tools they already use for addressing this task.
7776

7877
### Goals
7978

80-
- Enable users to generate Secrets using the tools they already have on their machines
81-
- Require Alice to opt-in inorder for Carl to execute commands on her machine
82-
- Support Linux / Mac / Windows platforms
79+
- Enable users to generate Secrets using the tools they already use to do so
80+
- Secure by default - Alice must configure her environment in an insecure manner and run the command in an
81+
insecure way for it to be exploitable
82+
- Support Linux / Mac / Windows OS's
8383

8484
### Non-Goals
8585

86-
- Enable an ecosystem of users authoring plugins and sharing them
87-
- Reduce friction for publicly published whitebox `kustomization.yaml`s to generate Secrets
88-
86+
- Support an ecosystem of users (i.e. not centralized within a single organization) authoring plugins
87+
and sharing them with one another.
88+
- Eliminate all friction for publicly published whitebox `kustomization.yaml`s to generate Secrets
8989

9090
## Proposal
9191

92-
Re-introduce `exec` Secret generators, but require the executables to have a whitelisted prefix
93-
and require a flag.
94-
95-
- Introduce a flag `--secret-generator-exec-prefix` defaulted to `kustomize-sg-`
96-
- Introduce a flag `--enable-exec-secret-generator` defaulted to `false`
97-
- Commands provided to generate Secrets *must* start with the prefix, or kustomize will exit 1
98-
- The enable flag *must* be provided if an exec Secret Generator is specified, or kustomize will exit 1
99-
- Command is executed from the `PATH` variable, it cannot be an absolute or relative path
100-
- This is to prevent Carl from publishing a malicious generator with the kustomization.yaml and invoking it
101-
- Users can override the prefix with a string value with `len(value) > 2` - e.g. `sg-`
102-
- Min length is to prevent users from providing an empty value, which would allow arbitrary command execution
92+
Re-introduce `exec` SecretGenerators, but with the following safeguards in place to address security concerns.
93+
94+
- Plugins must be explicitly enabled with a flag. If it is not enabled and is used, Kustomize will exit 1 without
95+
running exec.
96+
- This is to protect against the case where exploitable plugins are installed and used safely internally in an
97+
organization.
98+
- If exiting 1, Kustomize will first print the list of plugins exec commands that were not executed, and a message
99+
about the flag.
100+
- Executables are restricted to flag defined paths - defaulted a location that is empty by default. Users must install / symlink executables to this location.
101+
102+
### New Flags
103+
104+
|Feature | Name | Type | Default | Description |
105+
|----------|--------------------|----------|-------------------------------------------------|--------------|
106+
| `enabled`| `--enable-plugins` | bool | `false` | Enable plugins. If set to `false` and plugins are specified by the `kustomization.yaml` (recursively), then Kustomize will print the plugins that would be run and exit 1. |
107+
| `path` | `--plugin-path` | []string | ["`$XDG_CONFIG_HOME/kustomize/plugins/kvSources`", "`/usr/local/kustomize/plugins/kvSources`"] | List of relative or absolute paths to search for plugin actuators - e.g. for `exec` look for executables on these paths. For `go-plugins` look for `.so` files on these paths. Relative paths must are relative to the `kustomization.yaml` provided to the command. They are never not relative to the base `kustomization.yaml`s. |
108+
109+
### Example
110+
111+
#### Default Path
112+
113+
Note: `my-exec-plugin` exists at `$XDG_CONFIG_HOME/kustomize/plugins/kvSources/my-exec-plugin`
114+
115+
```yaml
116+
secretGenerator:
117+
- name: fromPlugins
118+
kvSources:
119+
- pluginType: exec
120+
name: my-exec-plugin
121+
args:
122+
- anotherArg
123+
- yetAnotherArg
124+
```
125+
126+
```sh
127+
$ kustomize build ./ --enable-plugins
128+
```
129+
130+
#### Flag Defined Absolute Path
131+
132+
Note: `my-exec-plugin` exists at `/foo/kvSources/my-exec-plugin`
133+
134+
```yaml
135+
secretGenerator:
136+
- name: fromPlugins
137+
kvSources:
138+
- pluginType: exec
139+
name: my-exec-plugin
140+
args:
141+
- anotherArg
142+
- yetAnotherArg
143+
```
144+
145+
```sh
146+
$ kustomize build ./ --enable-plugins --plugin-path=/foo/kvSources/
147+
```
148+
149+
#### Flag Defined Relative Path
150+
151+
Note: `my-exec-plugin` exists at `./my-exec-plugin`
152+
153+
```yaml
154+
secretGenerator:
155+
- name: fromPlugins
156+
kvSources:
157+
- pluginType: exec
158+
name: my-exec-plugin
159+
args:
160+
- anotherArg
161+
- yetAnotherArg
162+
```
163+
164+
```sh
165+
$ kustomize build ./ --enable-plugins --plugin-path=./
166+
```
167+
168+
#### Not Enabled
169+
170+
Note: `my-exec-plugin` exists at `/usr/local/kustomize/plugins/kvSources/my-exec-plugin`
171+
172+
```yaml
173+
secretGenerator:
174+
- name: fromPlugins
175+
kvSources:
176+
- pluginType: exec
177+
name: my-exec-plugin
178+
args:
179+
- anotherArg
180+
- yetAnotherArg
181+
```
182+
183+
```sh
184+
$ kustomize build ./
185+
```
186+
187+
Output:
188+
189+
```bash
190+
secretGenerator plugins used, but plugins not enabled. To enable plugins for trusted sources, specify --enable-plugins.
191+
secretGenerator plugins that will be run with --enable-plugins:
192+
$XDG_CONFIG_HOME/kustomize/plugins/builtin/my-exec-plugin anotherAg yetAnotherARg
193+
```
103194

104195
## Risks and Mitigations
105196

106197
### Security
107198

108-
**Risk:** Carl is able to exploit this feature to do something bad on Alice's machine
199+
**Risk:** Chuck is able to exploit this feature to do something bad on Alice's machine
109200

110201
Required steps to exploit:
111202

112-
- Alice executes (via `-k` or `kustomize`) an untrusted kustomization.yaml containing
113-
a SecretGenerator
114-
- Alice opted-in to generation by providing `--enable-exec-secret-generator`
115-
- Alice "installed" the targeted SecretGenerator locally on their PATH
116-
- Added the command starting with `kustomize-sg-` (or whatever they provided via the flag) to her `PATH`
117-
- The installed SecretGenerator can be provided arguments in a way that can be exploited
118-
- e.g. A command like `cat` would not be possible for Carl to exploit in a meaningful way
203+
- Alice executes (via `-k` or `kustomize`) a malicious `kustomization.yaml`
204+
- Alice does *not* run *without* enabling plugins with `--enable-plugins` to see which
205+
plugins will be run and with which values.
206+
- Alice opted-in to enable plugins by providing the flag `--enable-plugins`
207+
- Alice or her organization installed the targeted SecretGenerator to `$XDG_CONFIG_HOME/kustomize/plugins/kvSources`
208+
or another location she provided with `--plugin-path=<path-including-exploitable-binary>`
209+
- The specified SecretGenerator must be exploitable
210+
- Simple transformation functions would not be exploitable.
211+
- e.g. A command like `cat` would not be possible for Chuck to exploit in a meaningful way.
119212

120-
Analysis:
213+
Example Exploit Commands:
121214

122-
This is a very low risk profile, with Alice having to install the targeted binary on their
123-
PATH as a kustomize plugin (using the name-prefix), the binary would have to be one that could
124-
be exploited by Carl, Alice would need to run kustomize against an untrusted `kustomization.yaml`,
125-
and Alice would need to provide the flag `--enable-exec-secret-generator`. If Carl was able
126-
to get Alice to perform these steps, he would likely be able to get her to run
127-
`$ curl <site> | bash` which would be a more effective technique.
215+
In kustomize:
128216

129-
### Easy of Use
217+
```sh
218+
# User enables the plugin and allows it to exec sh
219+
$ kustomize build https://github.com/chuck/maliciousapp --enable-plugins --plugin-path=/bin
220+
```
130221

131-
**Risk:** This is too hard or confusing for users to use.
222+
In kubectl:
132223

133-
Required steps to use:
134-
135-
- Alice creates a script to generate the Secret called `kustomize-sg-my-cool-script.sh`
136-
- Alice adds the script to her PATH
137-
- Alice authors the `kustomization.yaml` with a SecretGenerator invoking the script
138-
- Alice runs kustomize with `--enable-exec-secret-generator`
224+
```sh
225+
# User enables the plugin and allows it to exec sh
226+
$ kubectl apply -k https://github.com/chuck/maliciousapp --enable-plugins --plugin-path=/bin
227+
```
139228

140229
Analysis:
141230

142-
There are a small number of simple and well defined steps that ensure Alice explicitly configures
143-
her environment so that kustomize can execute specific commands.
231+
This is a low risk profile. Alice has to: kustomize a malicious kustomization file,
232+
explicitly enable plugins as command line arguments, and install an exploitable plugin to
233+
exploit the plugin system.
234+
235+
By default kustomize will not-execute the plugins, and print out which plugins were specified
236+
with their arguments.
144237

145238
## Alternatives Considered
146239

147-
Create a plugin mechanism similar to git or kubectl plugins and exec to plugins only.
240+
### Git Style Plugins
241+
242+
Create a plugin mechanism similar to git or kubectl plugins which supports sub commands.
243+
244+
kubectl and git plugins are targeted at providing a clean interactive UX with extensible sub commands.
245+
Because the plugins will be invoked declaratively rather than imperatively support for this sort of
246+
UX is not necessary.
247+
248+
### Allow Transformers to do more
249+
250+
Allow Transformers to add / remove objects, or update their names / namespaces.
251+
252+
Why not: Greatly reduces the ability to look at the kustomize file and understand what
253+
will be emitted. e.g. a Transformer could change all ConfigMaps to Secrets, this would
254+
make it very difficult to read the Declarative Resource Config.
255+
256+
Reasons why not:
148257

149-
- Plugin mechanisms such as those used by git and kubectl provide a better ux experience when
150-
discovering and running imperative commands. This is not a good fit for declaring commands
151-
in a config file, as it is better to be explicit and clear about the command that is being run.
152-
- Plugin mechanisms encourage developing ecosystems of shared plugins. This feature is targeting
153-
existing tools that users already use, rather than developing new tools.
154-
- Plugin mechanisms don't offer additional security features over what is being proposed here, as
155-
they use the same mechanism with an implicit UX.
258+
1. Reduces readbility of the kustomization file by introducing complex changes to what is generated rather
259+
than kustomizations.
260+
1. Increases the likelihood that transformers will break reference updates - e.g. things that need to
261+
update references to other objects may break.
262+
1. No clear use case for this has been defined.
263+
1. Easy to lift these restrictions, hard to introduce them later.
156264

157265
## Graduation Criteria
158266

@@ -165,25 +273,36 @@ such is relatively well understood.
165273

166274
Gather user feedback. Determine if there are addressable gaps.
167275

276+
Consider the following:
277+
278+
#### Enable Plugins with Environment Variables
279+
280+
Allow users to specify `export KUSTOMIZE_ENABLE_PLUGINS=true` instead of providing the flag.
281+
282+
#### Audit Command
283+
284+
Add a new command in Kustomize: `kustomize audit dir/`
285+
286+
This will print out which commands (including args and flags) will be invoked when Kustomize is run,
287+
without actually invoking them. This will generally be helpful for users to view how secrets are generated.
288+
289+
#### More OS Specific install locations
290+
291+
Consider defaulting search path to include OS specific install locations such as `/Library/` or `~/Library` on OS X.
292+
293+
#### More Powerful Transformers
294+
295+
Lift restrictions on what transformers are allowed to do.
296+
168297
## Testing and documentation.
169298

170299
### Testing
171300

172-
- Verify the that if exec is used with a command that doesn't have the prefix, an error is returned
173-
without the command being executed.
174-
- If multiple commands exist, and some have the prefix and some don't, then none of the commands should be executed
175-
- Verify that if the user specifies the prefix flag, the new prefix is used.
176-
- Commands with the new prefix should work
177-
- Commands with the default prefix should now fail
178-
- Verify that if the enable flag is not provided, kustomize will exit 1 if and exec generators are provided
179-
- Even if they match the prefix
180-
- Verify absolute paths fail
181-
- Verify relative paths fail
182-
- Verify the happy case
301+
TBD.
183302

184303
### Documentation
185304

186-
Update the "Kubectl Book" Secret Generator chapter.
305+
TBD
187306

188307
## Implementation History
189308

0 commit comments

Comments
 (0)