hashicorp / hashicorp/vault-helm
[security improvement] Vault installation does not need to bind to system:auth-delegator clusterRole
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
Task: Installing Vault on top of latest stable OpenShift release 4.5.7 using the official helm-chart.
Realized that Vault server installation binds to an already defined clusterRole [helm template](https://github.com/hashicorp/vault-helm/blob/798ac9c59771d80c81092484467d18cae793f2da/templates/server-clusterrolebinding.yaml#L16) which includes two policyRules:
```
kubectl describe clusterrole system:auth-delegator
Name: system:auth-delegator
Labels: kubernetes.io/bootstrapping=rbac-defaults
Annotations: rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
Resources Non-Resource URLs Resource Names Verbs
--------- ----------------- -------------- -----
tokenreviews.authentication.k8s.io [] [] [create]
subjectaccessreviews.authorization.k8s.io [] [] [create]
```
Taking a look at the code and proved myself **subjectaccessreviews.authorization.k8s.io** policyRule is no needed to install Vault and deploy successfully any of the applications describe in [Vault Installation to Red Hat OpenShift via Helm](https://learn.hashicorp.com/tutorials/vault/kubernetes-openshift?in=vault/kubernetes)
**To Reproduce**
Steps to reproduce the behavior:
1. Create a custom clusterRole which only includes **tokenreviews.authentication.k8s.io** as resource in the policyRue. See [server-clusterrole.yaml](https://github.com/alosadagrande/vault-helm/blob/securityFix/templates/server-clusterrole.yaml)
2. Modify the existing clusterrolebinding to bind the previously created clusterRole: [server-clusterrolebinding.yaml](https://github.com/alosadagrande/vault-helm/blob/securityFix/templates/server-clusterrolebinding.yaml)
3. Install Vault on top of OpenShift as detailed in [Vault Installation to Red Hat OpenShift via Helm](https://learn.hashicorp.com/tutorials/vault/kubernetes-openshift?in=vault/kubernetes)
**Expected behavior**
The behaviour examined is that Vault server is successfully installed using helm. I could unseal the Vault server and deploy both the webapp and the issues application using the Kubernetes integration.
**Environment**
* Kubernetes version:
OpenShift version 4.5.7 (latest stable at the time of writing)
* vault-helm version:
vault-0.7.0
Contributor guide
Research direction
Start with templates/server-clusterrolebinding.yaml and compare it with the proposed templates/server-clusterrole.yaml and binding changes linked in the report. Render or install the chart on OpenShift using the documented Vault installation steps, then verify the binding grants only tokenreviews.authentication.k8s.io while Vault unseals and the example applications deploy successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100