mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-05 09:17:24 -08:00
138 lines
7.8 KiB
Markdown
138 lines
7.8 KiB
Markdown
# Kubelet Authentication & Authorization
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|
|
|
|
## Kubelet Authentication <a href="#kubelet-authentication" id="kubelet-authentication"></a>
|
|
|
|
[**From the docss:**](https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/)
|
|
|
|
By default, requests to the kubelet's HTTPS endpoint that are not rejected by other configured authentication methods are treated as anonymous requests, and given a **username of `system:anonymous`** and a **group of `system:unauthenticated`**.
|
|
|
|
The **3** authentication **methods** are:
|
|
|
|
* **Anonymous** (default): Use set setting the param **`--anonymous-auth=true` or the config:**
|
|
|
|
```json
|
|
"authentication": {
|
|
"anonymous": {
|
|
"enabled": true
|
|
},
|
|
```
|
|
|
|
* **Webhook**: This will **enable** the kubectl **API bearer tokens** as authorization (any valid token will be valid). Allow it with:
|
|
* ensure the `authentication.k8s.io/v1beta1` API group is enabled in the API server
|
|
* start the kubelet with the **`--authentication-token-webhook`** and **`--kubeconfig`** flags or use the following setting:
|
|
|
|
```json
|
|
"authentication": {
|
|
"webhook": {
|
|
"cacheTTL": "2m0s",
|
|
"enabled": true
|
|
},
|
|
```
|
|
|
|
{% hint style="info" %}
|
|
The kubelet calls the **`TokenReview` API** on the configured API server to **determine user information** from bearer tokens
|
|
{% endhint %}
|
|
|
|
* **X509 client certificates:** Allow to authenticate via X509 client certs
|
|
* see the [apiserver authentication documentation](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#x509-client-certs) for more details
|
|
* start the kubelet with the `--client-ca-file` flag, providing a CA bundle to verify client certificates with. Or with the config:
|
|
|
|
```json
|
|
"authentication": {
|
|
"x509": {
|
|
"clientCAFile": "/etc/kubernetes/pki/ca.crt"
|
|
}
|
|
}
|
|
```
|
|
|
|
## Kubelet Authorization <a href="#kubelet-authentication" id="kubelet-authentication"></a>
|
|
|
|
Any request that is successfully authenticated (including an anonymous request) **is then authorized**. The **default** authorization mode is **`AlwaysAllow`**, which **allows all requests**.
|
|
|
|
However, the other possible value is **`webhook`** (which is what you will be **mostly finding out there**). This mode will **check the permissions of the authenticated user** to allow or disallow an action.
|
|
|
|
{% hint style="warning" %}
|
|
Note that even if the **anonymous authentication is enabled** the **anonymous access** might **not have any permissions** to perform any action.
|
|
{% endhint %}
|
|
|
|
The authorization via webhook can be configured using the **param `--authorization-mode=Webhook`** or via the config file with:
|
|
|
|
```json
|
|
"authorization": {
|
|
"mode": "Webhook",
|
|
"webhook": {
|
|
"cacheAuthorizedTTL": "5m0s",
|
|
"cacheUnauthorizedTTL": "30s"
|
|
}
|
|
},
|
|
```
|
|
|
|
The kubelet calls the **`SubjectAccessReview`** API on the configured API server to **determine** whether each request is **authorized.**
|
|
|
|
The kubelet authorizes API requests using the same [request attributes](https://kubernetes.io/docs/reference/access-authn-authz/authorization/#review-your-request-attributes) approach as the apiserver:
|
|
|
|
* **Action**
|
|
|
|
| HTTP verb | request verb |
|
|
| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
| POST | create |
|
|
| GET, HEAD | get (for individual resources), list (for collections, including full object content), watch (for watching an individual resource or collection of resources) |
|
|
| PUT | update |
|
|
| PATCH | patch |
|
|
| DELETE | delete (for individual resources), deletecollection (for collections) |
|
|
|
|
* The **resource** talking to the Kubelet api is **always** **nodes** and **subresource** is **determined** from the incoming request's path:
|
|
|
|
| Kubelet API | resource | subresource |
|
|
| ------------ | -------- | ----------- |
|
|
| /stats/\* | nodes | stats |
|
|
| /metrics/\* | nodes | metrics |
|
|
| /logs/\* | nodes | log |
|
|
| /spec/\* | nodes | spec |
|
|
| _all others_ | nodes | proxy |
|
|
|
|
For example, the following request tried to access the pods info of kubelet without permission:
|
|
|
|
```bash
|
|
curl -k --header "Authorization: Bearer ${TOKEN}" 'https://172.31.28.172:10250/pods'
|
|
Forbidden (user=system:node:ip-172-31-28-172.ec2.internal, verb=get, resource=nodes, subresource=proxy)
|
|
```
|
|
|
|
* We got a **Forbidden**, so the request **passed the Authentication check**. If not, we would have got just an `Unauthorised` message.
|
|
* We can see the **username** (in this case from the token)
|
|
* Check how the **resource** was **nodes** and the **subresource** **proxy** (which makes sense with the previous information)
|
|
|
|
## References
|
|
|
|
* [https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/](https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/)
|
|
|
|
{% hint style="success" %}
|
|
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
|
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
|
|
|
<details>
|
|
|
|
<summary>Support HackTricks</summary>
|
|
|
|
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
|
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
|
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
|
|
|
</details>
|
|
{% endhint %}
|