-
Notifications
You must be signed in to change notification settings - Fork 261
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #1136 from anuddeeph1/CVE-2024-7646
Addressing the Latest Kubernetes NGINX Ingress Controller CVE-2024-7646 Vulnerability
- Loading branch information
Showing
7 changed files
with
226 additions
and
12 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
36 changes: 36 additions & 0 deletions
36
...k-ingress-nginx-controller-version-and-annotation-policy/.chainsaw-test/bad-resource.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: Ingress | ||
| metadata: | ||
| name: demo | ||
| annotations: | ||
| nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" | ||
| nginx.ingress.kubernetes.io/server-snippet: | | ||
| add_header X-Safe-Header "Safe Content"; | ||
| add_header X-Vuln-Header "Benign\r | ||
| HTTP/1.1 200 OK | ||
| Content-Type: text/html | ||
| <script>alert('XSS');</script> | ||
| --------"; | ||
| return 200 "Original Content"; | ||
| spec: | ||
| ingressClassName: nginx | ||
| rules: | ||
| - host: test.example.com | ||
| http: | ||
| paths: | ||
| - path: / | ||
| pathType: Prefix | ||
| backend: | ||
| service: | ||
| name: test-service | ||
| port: | ||
| number: 80 | ||
| --- | ||
| apiVersion: v1 | ||
| kind: Pod | ||
| metadata: | ||
| name: ingress-nginx-controller | ||
| spec: | ||
| containers: | ||
| - name: controller | ||
| image: registry.k8s.io/ingress-nginx/controller:v1.11.0 |
10 changes: 10 additions & 0 deletions
10
...nx-controller-version-and-annotation-policy/.chainsaw-test/chainsaw-step-01-assert-1.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: kyverno.io/v1 | ||
| kind: ClusterPolicy | ||
| metadata: | ||
| name: check-ingress-nginx-controller-version-and-annotation-policy | ||
| status: | ||
| conditions: | ||
| - reason: Succeeded | ||
| status: "True" | ||
| type: Ready | ||
|
|
32 changes: 32 additions & 0 deletions
32
...-ingress-nginx-controller-version-and-annotation-policy/.chainsaw-test/chainsaw-test.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| # yaml-language-server: $schema=https://raw.githubusercontent.com/kyverno/chainsaw/main/.schemas/json/test-chainsaw-v1alpha1.json | ||
| apiVersion: chainsaw.kyverno.io/v1alpha1 | ||
| kind: Test | ||
| metadata: | ||
| name: check-ingress-nginx-controller-version-and-annotation-policy | ||
| spec: | ||
| steps: | ||
| - name: step-01 | ||
| try: | ||
| - apply: | ||
| file: ../check-ingress-nginx-controller-version-and-annotation-policy.yaml | ||
| - name: step-02 | ||
| try: | ||
| - patch: | ||
| resource: | ||
| apiVersion: kyverno.io/v1 | ||
| kind: ClusterPolicy | ||
| metadata: | ||
| name: check-ingress-nginx-controller-version-and-annotation-policy | ||
| spec: | ||
| validationFailureAction: Enforce | ||
| - assert: | ||
| file: chainsaw-step-01-assert-1.yaml | ||
| - name: step-03 | ||
| try: | ||
| - apply: | ||
| file: good-resource.yaml | ||
| - apply: | ||
| expect: | ||
| - check: | ||
| ($error != null): true | ||
| file: bad-resource.yaml |
28 changes: 28 additions & 0 deletions
28
...-ingress-nginx-controller-version-and-annotation-policy/.chainsaw-test/good-resource.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| apiVersion: networking.k8s.io/v1 | ||
| kind: Ingress | ||
| metadata: | ||
| name: demo | ||
| annotations: | ||
| nginx.ingress.kubernetes.io/auth-tls-verify-client: "on" | ||
| spec: | ||
| ingressClassName: nginx | ||
| rules: | ||
| - host: test.example.com | ||
| http: | ||
| paths: | ||
| - path: / | ||
| pathType: Prefix | ||
| backend: | ||
| service: | ||
| name: test-service | ||
| port: | ||
| number: 80 | ||
| --- | ||
| apiVersion: v1 | ||
| kind: Pod | ||
| metadata: | ||
| name: ingress-nginx-controller-6bbf7f5879-bvh6l | ||
| spec: | ||
| containers: | ||
| - name: controller | ||
| image: registry.k8s.io/ingress-nginx/controller:v1.11.2 |
21 changes: 21 additions & 0 deletions
21
other/check-ingress-nginx-controller-version-and-annotation-policy/artifacthub-pkg.yml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| name: check-ingress-nginx-controller-version-and-annotation-policy | ||
| version: 1.0.0 | ||
| displayName: Ensure Valid Ingress NGINX Controller and Annotations | ||
| createdAt: "2024-08-26T13:14:30Z" | ||
| description: >- | ||
| This policy ensures that Ingress resources do not have certain disallowed annotations and that the ingress-nginx controller pod is running an appropriate version of the image. It checks for the presence of the `nginx.ingress.kubernetes.io/server-snippet` annotation and disallows its usage, enforces specific values for `auth-tls-verify-client`, and ensures that the ingress-nginx controller image is of the required version. | ||
| install: |- | ||
| ```shell | ||
| kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/other/check-ingress-nginx-controller-version-and-annotation-policy/check-ingress-nginx-controller-version-and-annotation-policy.yaml | ||
| ``` | ||
| keywords: | ||
| - kyverno | ||
| - Other | ||
| readme: | | ||
| This policy ensures that Ingress resources do not have certain disallowed annotations and that the ingress-nginx controller pod is running an appropriate version of the image. It checks for the presence of the `nginx.ingress.kubernetes.io/server-snippet` annotation and disallows its usage, enforces specific values for `auth-tls-verify-client`, and ensures that the ingress-nginx controller image is of the required version. | ||
| Refer to the documentation for more details on Kyverno annotations: https://artifacthub.io/docs/topics/annotations/kyverno/ | ||
| annotations: | ||
| kyverno/category: "Other" | ||
| kyverno/kubernetesVersion: "1.28" | ||
| kyverno/subject: "Deployment,ReplicaSet,StatefulSet,DaemonSet,Ingress" | ||
| digest: d4bd973c6d8628e8e8944b3bb1df68997cd39c50f18bdbe98c7df6d3942d96da |
87 changes: 87 additions & 0 deletions
87
...n-and-annotation-policy/check-ingress-nginx-controller-version-and-annotation-policy.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| apiVersion: kyverno.io/v1 | ||
| kind: ClusterPolicy | ||
| metadata: | ||
| name: check-ingress-nginx-controller-version-and-annotation-policy | ||
| annotations: | ||
| policies.kyverno.io/title: Ensure Valid Ingress NGINX Controller and Annotations | ||
| policies.kyverno.io/category: Ingress, Security | ||
| policies.kyverno.io/severity: high | ||
| kyverno.io/kyverno-version: 1.11.0 | ||
| policies.kyverno.io/minversion: 1.9.0 | ||
| kyverno.io/kubernetes-version: "1.28" | ||
| policies.kyverno.io/subject: Ingress, Pod | ||
| policies.kyverno.io/description: >- | ||
| This policy ensures that Ingress resources do not have certain disallowed annotations and that the ingress-nginx | ||
| controller Pod is running an appropriate version of the image. It checks for the presence of the | ||
| `nginx.ingress.kubernetes.io/server-snippet` annotation and disallows its usage, enforces specific values | ||
| for `auth-tls-verify-client`, and ensures that the ingress-nginx controller image is of the required version. | ||
| spec: | ||
| validationFailureAction: Audit | ||
| background: true | ||
| rules: | ||
| - name: validate-ingress-annotations | ||
| match: | ||
| resources: | ||
| kinds: | ||
| - Ingress | ||
| validate: | ||
| message: "The annotation nginx.ingress.kubernetes.io/server-snippet is not allowed." | ||
| pattern: | ||
| metadata: | ||
| annotations: | ||
| X(nginx.ingress.kubernetes.io/server-snippet): "" | ||
| - name: validate-auth-tls-verify-client | ||
| match: | ||
| resources: | ||
| kinds: | ||
| - Ingress | ||
| validate: | ||
| message: "auth-tls-verify-client annotation must be 'on', 'off', 'optional', or 'optional_no_ca'." | ||
| deny: | ||
| conditions: | ||
| any: | ||
| - key: "{{request.object.metadata.annotations.\"nginx.ingress.kubernetes.io/auth-tls-verify-client\"}}" | ||
| operator: AnyNotIn | ||
| value: | ||
| - "on" | ||
| - "off" | ||
| - "optional" | ||
| - "optional_no_ca" | ||
| - name: ensure-ingress-nginx-controller-version-pattern | ||
| match: | ||
| resources: | ||
| kinds: | ||
| - Pod | ||
| validate: | ||
| message: "The ingress-nginx controller image version must start with v1.11." | ||
| pattern: | ||
| spec: | ||
| containers: | ||
| - name: controller | ||
| image: "registry.k8s.io/ingress-nginx/controller:v1.11.*" | ||
|
|
||
| - name: deny-lower-ingress-nginx-controller-versions | ||
| match: | ||
| resources: | ||
| kinds: | ||
| - Pod | ||
| validate: | ||
| message: "The ingress-nginx controller image version must be v1.11.2 or greater." | ||
| deny: | ||
| conditions: | ||
| - key: "{{ request.object.spec.containers[?(@.name=='controller')].image }}" | ||
| operator: AnyIn | ||
| value: | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.11.0" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.11.1" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.10.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.9.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.8.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.7.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.6.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.5.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.4.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.3.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.2.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.1.*" | ||
| - "registry.k8s.io/ingress-nginx/controller:v1.0.*" |