Tighten discovery service permissions#29717
Conversation
greedy52
force-pushed
the
STeve/p471_limit_discovery_service_permission
branch
from
171d798 to
26255b6
Compare
greedy52
force-pushed
the
STeve/p471_limit_discovery_service_permission
branch
from
26255b6 to
512a838
Compare
greedy52
changed the title
greedy52
added
security
| return trace.Wrap(err) | ||
| } | ||
| // Don't allow discovery service to create databases with dynamic labels. | ||
| if a.hasBuiltinRole(types.RoleDiscovery) && len(database.GetDynamicLabels()) > 0 { |
There was a problem hiding this comment.
Can you please include the same check into kube endpoints?
There was a problem hiding this comment.
What is identity was generated for DBDiscovery and DBDatabse so the a.hasBuiltinRole(types.RoleDiscovery) && a.hasBuiltinRole(types.RoleDatabase) == true and CreateDatabase method was called from db agent process ?
There was a problem hiding this comment.
What is identity was generated for DBDiscovery and DBDatabse so the a.hasBuiltinRole(types.RoleDiscovery) && a.hasBuiltinRole(types.RoleDatabase) == true and CreateDatabase method was called from db agent process ?
DB service doesn't call CreateDatabase right? Worth testing this scenario but I don't think it should be a problem
There was a problem hiding this comment.
Can you please include the same check into kube endpoints?
Thanks! I missed as somehow i thought kube cluster doesn't have dynamic labels. Added now in 98d53a7
What is identity was generated for DBDiscovery and DBDatabse so the a.hasBuiltinRole(types.RoleDiscovery) && a.hasBuiltinRole(types.RoleDatabase) == true and CreateDatabase method was called from db agent process ?
DB service doesn't call CreateDatabase right? Worth testing this scenario but I don't think it should be a problem
Yes, database service doesn't call CreateDatabase. Also, even if it does it wouldn't be a problem:
Lines 42 to 45 in 8a1d0e2
Discovery vs database services in the same process use its own auth connector with a single system role.
greedy52
force-pushed
the
STeve/p471_limit_discovery_service_permission
branch
from
a43638d to
98d53a7
Compare
public-teleport-github-review-bot
Bot
removed the request for review
from flyinghermit
* Limit Discovery Service permission by cloud origin label * fix ut * disallow dynamic labels for kube cluster
* Limit Discovery Service permission by cloud origin label * fix ut * disallow dynamic labels for kube cluster
4 participants
Related issue https://github.com/gravitational/teleport-private/issues/471
KubernetesLabelsandDatabaseLabelsare changed from wildcard to onlycloudorigin.Will do changes on DB agent side (e.g. URL validation) in a separate change.