Question about access_api_server test

[aquasecurity]

Question about access_api_server test

[strigazi]

@oriagmon thoughts? You seem to be the author of this test.

[lizrice]

I think the way we should approach this is that kube-hunter explores what information is available from various endpoints, and shows that to the user. It is really up to the user to decide whether this is a risk or not. As an example, the CIS benchmark has long recommended turning off anonymous-auth access altogether on the API server, although many considered this overkill as it prevented anonymous access to health endpoints. One person's vulnerability is another person's useful functionality.

[strigazi]

Thanks for the reply @lizrice . That makes total sense.

The way the information is presented to the user though, is a little scary [0].
It is not clear that this is only discovery information that can help create
an attack, an attack though might not be possible.

[0]

Vulnerabilities
+----------------------+----------------------+----------------------+----------------------+----------------------+
| LOCATION             | CATEGORY             | VULNERABILITY        | DESCRIPTION          | EVIDENCE             |
+----------------------+----------------------+----------------------+----------------------+----------------------+
| xxxxxxxx-xxxxxxxxxxx | Remote Code          | Access to server API |  Accessing the       | {"kind":"APIVersions |
| xxxxxxxxxx:6443      | Execution            |                      | server API within a  | ","versions":["v1"], |
|                      |                      |                      | compromised pod      | ...                  |
|                      |                      |                      | would help an        |                      |
|                      |                      |                      | attacker gain full   |                      |
|                      |                      |                      | control over the     |                      |
|                      |                      |                      | cluster              |                      |
+----------------------+----------------------+----------------------+----------------------+----------------------+

[1]

$ kubectl describe clusterrole system:basic-user
Name:         system:basic-user
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources                                      Non-Resource URLs  Resource Names  Verbs
  ---------                                      -----------------  --------------  -----
  selfsubjectaccessreviews.authorization.k8s.io  []                 []              [create]
  selfsubjectrulesreviews.authorization.k8s.io   []                 []              [create]
$ kubectl describe clusterrole system:discovery
Name:         system:discovery
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate=true
PolicyRule:
  Resources  Non-Resource URLs       Resource Names  Verbs
  ---------  -----------------       --------------  -----
             [/api]                  []              [get]
             [/api/*]                []              [get]
             [/apis]                 []              [get]
             [/apis/*]               []              [get]
             [/healthz]              []              [get]
             [/openapi]              []              [get]
             [/openapi/*]            []              [get]
             [/swagger-2.0.0.pb-v1]  []              [get]
             [/swagger.json]         []              [get]
             [/swaggerapi]           []              [get]
             [/swaggerapi/*]         []              [get]
             [/version]              []              [get]
             [/version/]             []              [get]