Skip to content

Commit

Permalink
helm: add least privileges logic for secrets on ceph-csi-cephfs chart
Browse files Browse the repository at this point in the history
this allows the encryption KMS config to be granted secret access with
a least privilges policy.

Signed-off-by: Antoine C <[email protected]>
  • Loading branch information
acolombier committed May 15, 2024
1 parent b8bba0d commit 58ac9c4
Show file tree
Hide file tree
Showing 5 changed files with 20 additions and 7 deletions.
10 changes: 10 additions & 0 deletions charts/ceph-csi-cephfs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,15 @@ storageClass:
encryptionKMSID: kubernetes
```

#### Least privilege secret access

If you use the `metadata` and let RBAC created by the chart, permissions will be given
to access **only** the secret referenced in the `encryptionKMSConfig`. This is something
important to keep in mind, as a manual change to the config to point to another secret or
add further KMS config will not be authorized. If you wish to give CephCSI a global secret
access to the cluster, you may set `rbac.leastPrivileges` to `false`, and permissions will
be granted globally via a *ClusterRole*.

#### Known Issues Upgrading

- When upgrading to version >=3.7.0, you might encounter an error that the
Expand Down Expand Up @@ -127,6 +136,7 @@ charts and their default values.
| Parameter | Description | Default |
| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
| `rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `rbac.leastPrivileges` | Specifies whether RBAC resources should be created with a restricted scope when supported (only secrets supported currently) | `true` |
| `serviceAccounts.nodeplugin.create` | Specifies whether a nodeplugin ServiceAccount should be created | `true` |
| `serviceAccounts.nodeplugin.name` | The name of the nodeplugin ServiceAccount to use. If not set and create is true, a name is generated using the fullname | "" |
| `serviceAccounts.provisioner.create` | Specifies whether a provisioner ServiceAccount should be created | `true` |
Expand Down
3 changes: 1 addition & 2 deletions charts/ceph-csi-cephfs/templates/nodeplugin-clusterrole.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,6 @@ kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "ceph-csi-cephfs.nodeplugin.fullname" . }}
namespace: {{ .Release.Namespace }}
labels:
app: {{ include "ceph-csi-cephfs.name" . }}
chart: {{ include "ceph-csi-cephfs.chart" . }}
Expand All @@ -19,7 +18,7 @@ rules:
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get"]
{{- if and .Values.encryptionKMSConfig .Values.encryptionKMSConfig.secretNamespace (not (eq .Values.encryptionKMSConfig.secretNamespace .Release.Namespace)) }}
{{- if and .Values.encryptionKMSConfig .Values.encryptionKMSConfig.secretNamespace (not .Values.rbac.leastPrivileges) }}
# allow to read the encryption key used with the metadata KMS
- apiGroups: [""]
resources: ["secrets"]
Expand Down
5 changes: 3 additions & 2 deletions charts/ceph-csi-cephfs/templates/nodeplugin-role.yaml
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
{{- if .Values.rbac.create -}}
{{- if and .Values.encryptionKMSConfig .Values.encryptionKMSConfig.secretNamespace .Values.encryptionKMSConfig.secretName (eq .Values.encryptionKMSConfig.secretNamespace .Release.Namespace) -}}
{{- if and .Values.rbac.create .Values.rbac.leastPrivileges -}}
{{- if and .Values.encryptionKMSConfig (eq .Values.encryptionKMSConfig.encryptionKMSType "metadata") .Values.encryptionKMSConfig.secretNamespace .Values.encryptionKMSConfig.secretName -}}
kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "ceph-csi-cephfs.nodeplugin.fullname" . }}
namespace: {{ .Values.encryptionKMSConfig.secretNamespace }}
labels:
app: {{ include "ceph-csi-cephfs.name" . }}
chart: {{ include "ceph-csi-cephfs.chart" . }}
Expand Down
6 changes: 3 additions & 3 deletions charts/ceph-csi-cephfs/templates/nodeplugin-rolebinding.yaml
Original file line number Diff line number Diff line change
@@ -1,10 +1,10 @@
{{- if .Values.rbac.create -}}
{{- if and (eq .Values.encryptionKMSConfig.encryptionKMSType "metadata") (eq .Values.encryptionKMSConfig.secretNamespace .Release.Namespace) -}}
{{- if and .Values.rbac.create .Values.rbac.leastPrivileges -}}
{{- if and .Values.encryptionKMSConfig (eq .Values.encryptionKMSConfig.encryptionKMSType "metadata") .Values.encryptionKMSConfig.secretNamespace -}}
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
name: {{ include "ceph-csi-cephfs.nodeplugin.fullname" . }}
namespace: {{ .Release.Namespace }}
namespace: {{ .Values.encryptionKMSConfig.secretNamespace }}
labels:
app: {{ include "ceph-csi-cephfs.name" . }}
chart: {{ include "ceph-csi-cephfs.chart" . }}
Expand Down
3 changes: 3 additions & 0 deletions charts/ceph-csi-cephfs/values.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,9 @@
rbac:
# Specifies whether RBAC resources should be created
create: true
# When possible try and reduce the scope of permission to only give
# access to resources defined in the config. See the README for more info
leastPrivileges: true

serviceAccounts:
nodeplugin:
Expand Down

0 comments on commit 58ac9c4

Please sign in to comment.