Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🐛 Fix security concerns by only enabling FilterProvider to protect the metrics endpoint with authn/authz when secureMetrics is true #4022

Merged
merged 1 commit into from
Jul 22, 2024
Merged

🐛 Fix security concerns by only enabling FilterProvider to protect the metrics endpoint with authn/authz when secureMetrics is true #4022

merged 1 commit into from
Jul 22, 2024
+217 −178

Conversation

alex-kattathra-johnson
Copy link
Contributor

@alex-kattathra-johnson alex-kattathra-johnson commented Jul 17, 2024 •
edited
Loading

Description

Enable filters.WithAuthenticationAndAuthorization only when secureMetrics is true

Motivation

Resolve #4020

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 17, 2024
@k8s-ci-robot
Copy link
Contributor

Welcome @alex-kattathra-johnson!

It looks like this is your first PR to kubernetes-sigs/kubebuilder 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/kubebuilder has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 17, 2024
@k8s-ci-robot
Copy link
Contributor

Hi @alex-kattathra-johnson. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@alex-kattathra-johnson alex-kattathra-johnson changed the title Conditionally enable FilterProvider in mainTemplate bug: Conditionally enable FilterProvider in mainTemplate Jul 17, 2024
@alex-kattathra-johnson alex-kattathra-johnson changed the title bug: Conditionally enable FilterProvider in mainTemplate 🐛 : Conditionally enable FilterProvider in mainTemplate Jul 17, 2024
@alex-kattathra-johnson alex-kattathra-johnson force-pushed the issue-4020 branch 2 times, most recently from daab89a to 5e8b24f Compare July 17, 2024 16:44
@alex-kattathra-johnson alex-kattathra-johnson changed the title 🐛 : Conditionally enable FilterProvider in mainTemplate 🐛 Conditionally enable FilterProvider in mainTemplate Jul 17, 2024
@alex-kattathra-johnson alex-kattathra-johnson changed the title 🐛 Conditionally enable FilterProvider in mainTemplate 🐛 Fix security concerns by only enabling FilterProvider to protect the metrics endpoint with authn/authz when secureMetrics is true Jul 17, 2024
@camilamacedo86 camilamacedo86 self-requested a review July 18, 2024 09:58
camilamacedo86
camilamacedo86 requested changes Jul 19, 2024
View reviewed changes
Copy link
Member

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to try address the above ones so that we can get this one merged

docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go Outdated Show resolved Hide resolved
@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jul 19, 2024
camilamacedo86
camilamacedo86 reviewed Jul 19, 2024
View reviewed changes
Copy link
Member

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jul 19, 2024
camilamacedo86
camilamacedo86 reviewed Jul 19, 2024
View reviewed changes
docs/book/src/cronjob-tutorial/testdata/project/cmd/main.go
// can access the metrics endpoint. The RBAC are configured in 'config/rbac/kustomization.yaml'. More info:
// https://pkg.go.dev/sigs.k8s.io/[email protected]/pkg/metrics/filters#WithAuthenticationAndAuthorization
metricsServer.FilterProvider = filters.WithAuthenticationAndAuthorization
}
Copy link
Member

@camilamacedo86 camilamacedo86 Jul 19, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 I liked it
Great work

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@sbueringer wdyt?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks perfect, thx!

Conditionally enable FilterProvider in mainTemplate
59a92f7 
* Enable `filters.WithAuthenticationAndAuthorization` only when `secureMetrics` is true

Signed-off-by: Alex Johnson <[email protected]>
camilamacedo86
camilamacedo86 reviewed Jul 19, 2024
View reviewed changes
docs/book/src/reference/metrics.md
...
if secureMetrics {
...
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

camilamacedo86
camilamacedo86 reviewed Jul 19, 2024
View reviewed changes
Copy link
Member

@camilamacedo86 camilamacedo86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work 🥇
Terrific 🚀

I am approving this one
/approve

It would be nice get the input/LGTM from @sbueringer since he was who spot this one

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 19, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alex-kattathra-johnson, camilamacedo86

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sbueringer
Copy link
Member

Thank you!

/lgtm

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jul 22, 2024
@k8s-ci-robot k8s-ci-robot merged commit 4c4103e into kubernetes-sigs:master Jul 22, 2024
18 checks passed
@alex-kattathra-johnson alex-kattathra-johnson deleted the issue-4020 branch July 22, 2024 13:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@camilamacedo86 camilamacedo86 camilamacedo86 approved these changes

@varshaprasad96 varshaprasad96 Awaiting requested review from varshaprasad96

@sbueringer sbueringer Awaiting requested review from sbueringer

Assignees

@sbueringer sbueringer

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Conditionally Enable filters.WithAuthenticationAndAuthorization Only When secureMetrics is True
4 participants
@alex-kattathra-johnson @k8s-ci-robot @sbueringer @camilamacedo86