auth token should not be listed on command line about kube-mgmt HOT 9 CLOSED

from kube-mgmt.

It may be possible to refer to an environment variable in the command line arguments and then load the secret that way. I'll try this out and reply here. If that doesn't work, perhaps we ought to let users specify the token via environment variables. That seems like the simplest approach for now.

RE: mutual TLS, OPA does not currently support that in the HTTP server. We have an open issue for this open-policy-agent/opa#1040.

from kube-mgmt.

Either would work -- storing the token in an environment variable means the Kubernetes deployment can keep it in a Secret. If someone can get on the pod to view the environment, they can probably get the secret if it's in a file, too.

from kube-mgmt.

I am going to try to use the secret in an environment variable and use that env variable in the command line. Will update here. But as @gnealhou mentioned the secret will be visible on entering the kube-mgmt pod.

from kube-mgmt.

With the below config, the OPA authentication token will not be seen on the command line and the deployment but will be seen on entering the kube-mgmt container.

1. Create a secret.

kubectl create secret generic kube-token --from-literal=token='kube-mgmt'

kc describe secret kube-token
Name:         kube-token
Namespace:    opa
Labels:       <none>
Annotations:  <none>

Type:  Opaque

Data
====
token:  9 bytes

2. Use secret as environment variable in kube-mgmt container.

- name: kube-mgmt
   image: openpolicyagent/kube-mgmt:0.8-dev
   args:
       - "--opa-auth-token=$(SECRET_TOKEN)"
    env:
       - name: SECRET_TOKEN
          valueFrom:
              secretKeyRef:
                  name: kube-token
                  key: token

3. Check pod

kc get pods
NAME                   READY     STATUS    RESTARTS   AGE
opa-55bd755cd7-2rdl2   2/2       Running   0          5m

kc exec -it opa-55bd755cd7-2rdl2 -c kube-mgmt /bin/sh
/ # ps fax
PID   USER     TIME  COMMAND
    1 root      0:00 /kube-mgmt --opa-auth-token=kube-mgmt
   11 root      0:00 /bin/sh
   18 root      0:00 ps fax

@gnealhou What do you think ?

from kube-mgmt.

Closing this as the auth token is reasonable secure and no longer listed on the command line.

from kube-mgmt.

Its more secure, but could still leak out in unexpected ways. For example, something from the host that is looking at what processes are running, or logs that contain similar info. I'd much prefer if there was a way to set it by environment variable so it never shows up on a command line.

Can we reopen this issue please?

from kube-mgmt.

reading it out of a file would also be very useful.

from kube-mgmt.

@kfox1111 someone with access to the container can still see the token, right ?

from kube-mgmt.