Ensure defaultMode=0400 for projected volumes containing secrets

Follow cilium/cilium#17367: It seems that these volumes were wrongly given permission 420 instead of 0400, giving write permission to the group. In all instances, the actual volumeMounts were set to readonly so this change should have no effect but better be more cautious about permissions for secrets. Reported-by: Robin Hahling <[email protected]> Signed-off-by: Tobias Klauser <[email protected]>
cilium · Sep 14, 2021 · 39df2bb · 39df2bb
1 parent 0441b3e
commit 39df2bb
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/clustermesh/clustermesh.go b/clustermesh/clustermesh.go
@@ -46,7 +46,7 @@ var (
 	replicas                 = int32(1)
 	deploymentMaxSurge       = intstr.FromInt(1)
 	deploymentMaxUnavailable = intstr.FromInt(1)
-	secretDefaultMode        = int32(420)
+	secretDefaultMode        = int32(0400)
 )
 
 var clusterRole = &rbacv1.ClusterRole{

diff --git a/hubble/relay.go b/hubble/relay.go
@@ -27,6 +27,7 @@ const (
 )
 
 var (
+	secretDefaultMode        = int32(0400)
 	relayReplicas            = int32(1)
 	relayPortIntstr          = intstr.FromInt(defaults.RelayPort)
 	deploymentMaxSurge       = intstr.FromInt(1)
@@ -168,6 +169,7 @@ func (k *K8sHubble) generateRelayDeployment() *appsv1.Deployment {
 							Name: "tls",
 							VolumeSource: corev1.VolumeSource{
 								Projected: &corev1.ProjectedVolumeSource{
+									DefaultMode: &secretDefaultMode,
 									Sources: []corev1.VolumeProjection{
 										{
 											Secret: &corev1.SecretProjection{

diff --git a/install/install.go b/install/install.go
@@ -37,7 +37,7 @@ var (
 	agentTerminationGracePeriodSeconds = int64(1)
 	hostPathDirectoryOrCreate          = corev1.HostPathDirectoryOrCreate
 	hostPathFileOrCreate               = corev1.HostPathFileOrCreate
-	secretDefaultMode                  = int32(420)
+	secretDefaultMode                  = int32(0400)
 	operatorReplicas                   = int32(1)
 	operatorMaxSurge                   = intstr.FromInt(1)
 	operatorMaxUnavailable             = intstr.FromInt(1)
@@ -594,6 +594,7 @@ func (k *K8sInstaller) generateAgentDaemonSet() *appsv1.DaemonSet {
 							Name: "hubble-tls",
 							VolumeSource: corev1.VolumeSource{
 								Projected: &corev1.ProjectedVolumeSource{
+									DefaultMode: &secretDefaultMode,
 									Sources: []corev1.VolumeProjection{
 										{
 											Secret: &corev1.SecretProjection{