Describe the bug
We identified overly permissive Role-Based Access Control (RBAC) rules that grant access to sensitive Kubernetes resources or security-critical operations. Such excessive permissions violate the principle of least privilege and may compromise the confidentiality and integrity of cluster resources.
Unrestricted Secret Access. The RBAC rule allows reading Secrets without restricting access to specific resource names. This may expose sensitive credentials, tokens, API keys, or certificates stored in Secrets. Access should be limited to only the required Secrets by using resourceName and the minimum necessary verbs.
Location:
|
resources: |
|
- "namespaces" |
|
- "secrets" |
|
- "configmaps" |
|
- "services" |
|
- "events" |
|
- "serviceaccounts" |
|
- "pods" |
|
- "serviceaccounts/token" |
|
verbs: |
|
- "get" |
|
- "list" |
|
- "create" |
|
- "update" |
|
- "delete" |
|
- "patch" |
|
- "watch" |
References: Kubernetes RBAC Good Practices: Listing Secrets, Kubernetes Secrets Good Practices, and MITRE ATT&CK: Unsecured Credentials in Secrets (T1552.007).
CustomResourceDefinition Management. The RBAC rule allows creating, modifying, or deleting CustomResourceDefinitions (CRDs). This permission allows an identity to modify the cluster API schema, potentially introduce malicious custom resources, or disrupt custom controllers and operators that depend on existing CRDs. CRD management should be restricted to trusted cluster administrators and removed when it is not required by the application.
Location:
|
- apiGroups: ["apiextensions.k8s.io"] |
|
resources: ["customresourcedefinitions"] |
|
verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] |
Reference: Kubernetes Custom Resources and CustomResourceDefinitions.
Expected behavior
The application should request only the minimum RBAC permissions required for its intended functionality. Permissions that provide access to sensitive information or security-critical operations should be removed, restricted, or limited to the specific resources and operations required by the application.
Knative release version
Additional context
Add any other context about the problem here such as proposed priority
Describe the bug
We identified overly permissive Role-Based Access Control (RBAC) rules that grant access to sensitive Kubernetes resources or security-critical operations. Such excessive permissions violate the principle of least privilege and may compromise the confidentiality and integrity of cluster resources.
Unrestricted Secret Access. The RBAC rule allows reading Secrets without restricting access to specific resource names. This may expose sensitive credentials, tokens, API keys, or certificates stored in Secrets. Access should be limited to only the required Secrets by using resourceName and the minimum necessary verbs.
Location:
eventing/config/core/roles/controller-clusterroles.yaml
Lines 25 to 41 in 5411419
References: Kubernetes RBAC Good Practices: Listing Secrets, Kubernetes Secrets Good Practices, and MITRE ATT&CK: Unsecured Credentials in Secrets (T1552.007).
CustomResourceDefinition Management. The RBAC rule allows creating, modifying, or deleting CustomResourceDefinitions (CRDs). This permission allows an identity to modify the cluster API schema, potentially introduce malicious custom resources, or disrupt custom controllers and operators that depend on existing CRDs. CRD management should be restricted to trusted cluster administrators and removed when it is not required by the application.
Location:
eventing/config/core/roles/webhook-clusterrole.yaml
Lines 184 to 186 in 5411419
Reference: Kubernetes Custom Resources and CustomResourceDefinitions.
Expected behavior
The application should request only the minimum RBAC permissions required for its intended functionality. Permissions that provide access to sensitive information or security-critical operations should be removed, restricted, or limited to the specific resources and operations required by the application.
Knative release version
Additional context
Add any other context about the problem here such as proposed priority