Cannot upgrade to the latest Kubernetes orchestrator using the latest acs-engine (0.26.0)

[orlandoalexandrescu]

Cannot upgrade to the latest Kubernetes orchestrator using the latest acs-engine (0.26.0)

[Michael-Sinz]

We have the same issue - we need to get to 1.10.11 in our clusters.

[pascalgn]

Depending on your threat model

The second method lets an unauthenticated user access the API to create unapproved services
(kubernetes/kubernetes#71411)

might be the much more important issue at the moment (it is for us).

Mitigations for the anonymous user -> aggregated API server escalation include:
disable anonymous requests by passing --anonymous-auth=false to the kube-apiserver (note that this may disrupt load balancer or kubelet health checks of the kube-apiserver, and breaks kubeadm join setup flows)

However, at least when using acs-engine, this already seems to be the default:
--anonymous-auth=false (see docs/clusterdefinition.md)

So from my understanding, anonymous access will not be possible when setting up a cluster with acs-engine (provided default options are used). The other issues of CVE-2018-1002105 are unaffected from this, though!

[CecileRobertMichon]

@pascalgn is correct, acs-engine clusters have --anonymous-auth=false which means they are not affected (that value is not user-configurable).

That being said, we will have a patch release containing 1.11.5 coming shortly (ETA today).

[CecileRobertMichon]

https://github.com/Azure/acs-engine/releases/tag/v0.26.1