Update the KEP with clarity around localhost probes #5444
Conversation
k8s-ci-robot
added
kind/kep
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: tssurya The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
sig/auth
|
/retitle Update the KEP with clarity around localhost probes |
k8s-ci-robot
changed the title
Signed-off-by: Surya Seetharaman <[email protected]>
tssurya
force-pushed
the
update-sig-auth-kep-psa-host-field-on-probes
branch
from
762bd99 to
05443f3
Compare
k8s-ci-robot
added
size/M
| @@ -88,7 +88,8 @@ lead to blind SSRF attacks. | |||
| ### Goals | |||
|
|
|||
| * Add Pod Security Admission (PSA) to enable admins to restrict | |||
| users from creating probes with the `Host` field set. | |||
| users from creating probes with the `Host` field set to disallowed | |||
| values. The only allowed values will be `127.0.0.1` and `::1`. | |||
There was a problem hiding this comment.
127.0.0.1 in a probe means localhost on the node host network.
Isn't that only valid for host network pods? The baseline pod security policy forbids hostNetwork: true and hostPort: ... pods, so I'm not sure why we'd allow probes that only work for host network pods.
There was a problem hiding this comment.
agree with @liggitt based on what was mentioned kubernetes/kubernetes#125271 (comment) I don't think we need to add this update to the enhancement. Original version looks good.
Addresses review comment #4942 (comment) from @BenTheElder and @danwinship . Though I removed deprecation area totally I forgot to mention probes using "localhost" IP will continue to be allowed.
cc @deads2k / @liggitt