Skip to content

Commit ebdd90f

Browse files
rurikudorurikudo
authored
change api and observer roles to the minimum privileges (#353)
Signed-off-by: ruriko <[email protected]>
1 parent b0b22c8 commit ebdd90f

File tree

3 files changed

+109
-17
lines changed

3 files changed

+109
-17
lines changed

‎integrity-shield-operator/controllers/integrityshield.go

Lines changed: 20 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -517,14 +517,14 @@ func (r *IntegrityShieldReconciler) deleteClusterRoleBindingForIShield(
517517
return r.deleteClusterRoleBinding(instance, expected)
518518
}
519519

520-
// cluster role binding for observer sa
521-
func (r *IntegrityShieldReconciler) createOrUpdateObserverClusterRoleBindingForIShield(
520+
// cluster role binding - observer
521+
func (r *IntegrityShieldReconciler) createOrUpdateClusterRoleBindingForObserver(
522522
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
523523
expected := res.BuildClusterRoleBindingForObserver(instance)
524524
return r.createOrUpdateClusterRoleBinding(instance, expected)
525525
}
526526

527-
func (r *IntegrityShieldReconciler) deleteObserverClusterRoleBindingForIShield(
527+
func (r *IntegrityShieldReconciler) deleteClusterRoleBindingForObserver(
528528
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
529529
expected := res.BuildClusterRoleBindingForObserver(instance)
530530
return r.deleteClusterRoleBinding(instance, expected)
@@ -543,14 +543,14 @@ func (r *IntegrityShieldReconciler) deleteClusterRoleForIShield(
543543
return r.deleteClusterRole(instance, expected)
544544
}
545545

546-
// cluster role for observer sa
547-
func (r *IntegrityShieldReconciler) createOrUpdateObserverClusterRoleForIShield(
546+
// cluster role - observer
547+
func (r *IntegrityShieldReconciler) createOrUpdateClusterRoleForObserver(
548548
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
549549
expected := res.BuildClusterRoleForObserver(instance)
550550
return r.createOrUpdateClusterRole(instance, expected)
551551
}
552552

553-
func (r *IntegrityShieldReconciler) deleteObserverClusterRoleForIShield(
553+
func (r *IntegrityShieldReconciler) deleteClusterRoleForObserver(
554554
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
555555
expected := res.BuildClusterRoleForObserver(instance)
556556
return r.deleteClusterRole(instance, expected)
@@ -563,13 +563,27 @@ func (r *IntegrityShieldReconciler) createOrUpdateRoleBindingForIShield(
563563
return r.createOrUpdateRoleBinding(instance, expected)
564564
}
565565

566+
// role binding - observer
567+
func (r *IntegrityShieldReconciler) createOrUpdateRoleBindingForObserver(
568+
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
569+
expected := res.BuildRoleBindingForObserver(instance)
570+
return r.createOrUpdateRoleBinding(instance, expected)
571+
}
572+
566573
// role
567574
func (r *IntegrityShieldReconciler) createOrUpdateRoleForIShield(
568575
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
569576
expected := res.BuildRoleForIShield(instance)
570577
return r.createOrUpdateRole(instance, expected)
571578
}
572579

580+
// role - observer
581+
func (r *IntegrityShieldReconciler) createOrUpdateRoleForObserver(
582+
instance *apiv1.IntegrityShield) (ctrl.Result, error) {
583+
expected := res.BuildRoleForObserver(instance)
584+
return r.createOrUpdateRole(instance, expected)
585+
}
586+
573587
func (r *IntegrityShieldReconciler) createOrUpdatePodSecurityPolicy(instance *apiv1.IntegrityShield) (ctrl.Result, error) {
574588
ctx := context.Background()
575589
expected := res.BuildPodSecurityPolicy(instance)

‎integrity-shield-operator/controllers/integrityshield_controller.go

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -100,13 +100,13 @@ func (r *IntegrityShieldReconciler) Reconcile(ctx context.Context, req ctrl.Requ
100100
return ctrl.Result{}, nil
101101
}
102102

103-
// Pod Security Policy (PSP)
103+
//Pod Security Policy (PSP)
104104
recResult, recErr = r.createOrUpdatePodSecurityPolicy(instance)
105105
if recErr != nil || recResult.Requeue {
106106
return recResult, recErr
107107
}
108108

109-
// Config
109+
//Config
110110
recResult, recErr = r.createOrUpdateRequestHandlerConfig(instance)
111111
if recErr != nil || recResult.Requeue {
112112
return recResult, recErr
@@ -143,22 +143,37 @@ func (r *IntegrityShieldReconciler) Reconcile(ctx context.Context, req ctrl.Requ
143143

144144
// Observer
145145
if instance.Spec.Observer.Enabled {
146+
//CRD
146147
recResult, recErr = r.createOrUpdateObserverResultCRD(instance)
147148
if recErr != nil || recResult.Requeue {
148149
return recResult, recErr
149150
}
151+
//Service Account
150152
recResult, recErr = r.createOrUpdateObserverServiceAccount(instance)
151153
if recErr != nil || recResult.Requeue {
152154
return recResult, recErr
153155
}
154-
recResult, recErr = r.createOrUpdateObserverClusterRoleForIShield(instance)
156+
//Cluster Role
157+
recResult, recErr = r.createOrUpdateClusterRoleForObserver(instance)
155158
if recErr != nil || recResult.Requeue {
156159
return recResult, recErr
157160
}
158-
recResult, recErr = r.createOrUpdateObserverClusterRoleBindingForIShield(instance)
161+
//Cluster Role Binding
162+
recResult, recErr = r.createOrUpdateClusterRoleBindingForObserver(instance)
159163
if recErr != nil || recResult.Requeue {
160164
return recResult, recErr
161165
}
166+
//Role
167+
recResult, recErr = r.createOrUpdateRoleForObserver(instance)
168+
if recErr != nil || recResult.Requeue {
169+
return recResult, recErr
170+
}
171+
//Role Binding
172+
recResult, recErr = r.createOrUpdateRoleBindingForObserver(instance)
173+
if recErr != nil || recResult.Requeue {
174+
return recResult, recErr
175+
}
176+
//Deployment
162177
recResult, recErr = r.createOrUpdateObserverDeployment(instance)
163178
if recErr != nil || recResult.Requeue {
164179
return recResult, recErr
@@ -167,7 +182,6 @@ func (r *IntegrityShieldReconciler) Reconcile(ctx context.Context, req ctrl.Requ
167182

168183
// Gatekeeper
169184
if instance.Spec.UseGatekeeper {
170-
171185
// Shield API Secret
172186
recResult, recErr = r.createOrUpdateTlsSecret(instance)
173187
if recErr != nil || recResult.Requeue {
@@ -291,11 +305,11 @@ func (r *IntegrityShieldReconciler) deleteClusterScopedChildrenResources(instanc
291305
}
292306

293307
if instance.Spec.Observer.Enabled {
294-
_, err = r.deleteObserverClusterRoleForIShield(instance)
308+
_, err = r.deleteClusterRoleForObserver(instance)
295309
if err != nil {
296310
return err
297311
}
298-
_, err = r.deleteObserverClusterRoleBindingForIShield(instance)
312+
_, err = r.deleteClusterRoleBindingForObserver(instance)
299313
if err != nil {
300314
return err
301315
}

‎integrity-shield-operator/resources/role.go

Lines changed: 68 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,10 @@ func BuildClusterRoleForIShield(cr *apiv1.IntegrityShield) *rbacv1.ClusterRole {
7676
Rules: []rbacv1.PolicyRule{
7777
{
7878
APIGroups: []string{
79-
"", "apis.integrityshield.io",
79+
"apis.integrityshield.io",
8080
},
8181
Resources: []string{
82-
"secrets", "manifestintegrityprofiles",
82+
"manifestintegrityprofiles",
8383
},
8484
Verbs: []string{
8585
"get", "list", "watch", "patch", "update",
@@ -198,7 +198,6 @@ func BuildRoleForIShield(cr *apiv1.IntegrityShield) *rbacv1.Role {
198198
return role
199199
}
200200

201-
// TODO: should be minimum privilege
202201
func BuildClusterRoleForObserver(cr *apiv1.IntegrityShield) *rbacv1.ClusterRole {
203202
labels := map[string]string{
204203
"app": cr.Name,
@@ -221,7 +220,37 @@ func BuildClusterRoleForObserver(cr *apiv1.IntegrityShield) *rbacv1.ClusterRole
221220
"*",
222221
},
223222
Verbs: []string{
224-
"get", "list", "create", "update",
223+
"get", "list",
224+
},
225+
},
226+
},
227+
}
228+
return role
229+
}
230+
231+
func BuildRoleForObserver(cr *apiv1.IntegrityShield) *rbacv1.Role {
232+
labels := map[string]string{
233+
"app": cr.Name,
234+
"app.kubernetes.io/name": cr.Name,
235+
"app.kubernetes.io/managed-by": "operator",
236+
"role": "security",
237+
}
238+
role := &rbacv1.Role{
239+
ObjectMeta: metav1.ObjectMeta{
240+
Name: cr.Spec.Security.ObserverRole,
241+
Namespace: cr.Namespace,
242+
Labels: labels,
243+
},
244+
Rules: []rbacv1.PolicyRule{
245+
{
246+
APIGroups: []string{
247+
"apis.integrityshield.io", "",
248+
},
249+
Resources: []string{
250+
"manifestintegritystates", "configmaps",
251+
},
252+
Verbs: []string{
253+
"get", "list", "create", "watch", "patch", "update",
225254
},
226255
},
227256
},
@@ -249,6 +278,11 @@ func BuildRoleBindingForIShield(cr *apiv1.IntegrityShield) *rbacv1.RoleBinding {
249278
Name: cr.Spec.Security.APIServiceAccountName,
250279
Namespace: cr.Namespace,
251280
},
281+
{
282+
Kind: "ServiceAccount",
283+
Name: cr.Spec.Security.ObserverServiceAccountName,
284+
Namespace: cr.Namespace,
285+
},
252286
},
253287
RoleRef: rbacv1.RoleRef{
254288
APIGroup: "rbac.authorization.k8s.io",
@@ -259,6 +293,36 @@ func BuildRoleBindingForIShield(cr *apiv1.IntegrityShield) *rbacv1.RoleBinding {
259293
return rolebinding
260294
}
261295

296+
//role-binding observer
297+
func BuildRoleBindingForObserver(cr *apiv1.IntegrityShield) *rbacv1.RoleBinding {
298+
labels := map[string]string{
299+
"app": cr.Name,
300+
"app.kubernetes.io/name": cr.Name,
301+
"app.kubernetes.io/managed-by": "operator",
302+
"role": "security",
303+
}
304+
rolebinding := &rbacv1.RoleBinding{
305+
ObjectMeta: metav1.ObjectMeta{
306+
Name: cr.Spec.Security.ObserverRoleBinding,
307+
Namespace: cr.Namespace,
308+
Labels: labels,
309+
},
310+
Subjects: []rbacv1.Subject{
311+
{
312+
Kind: "ServiceAccount",
313+
Name: cr.Spec.Security.ObserverServiceAccountName,
314+
Namespace: cr.Namespace,
315+
},
316+
},
317+
RoleRef: rbacv1.RoleRef{
318+
APIGroup: "rbac.authorization.k8s.io",
319+
Kind: "Role",
320+
Name: cr.Spec.Security.ObserverRole,
321+
},
322+
}
323+
return rolebinding
324+
}
325+
262326
func BuildClusterRoleBindingForObserver(cr *apiv1.IntegrityShield) *rbacv1.ClusterRoleBinding {
263327
labels := map[string]string{
264328
"app": cr.Name,

0 commit comments

Comments
 (0)