Robert Bohne rbo

Hi everyone,

I ran into the article Kubernetes Pod Escape Using Log Mounts [1]. From my point of view, OpenShift is NOT affected. Because: You can not create an HostPath "mount" without cluster-admin privileges or access to the SCC hostaccess or hostmount-anyuid. Imagine you are able to start a Pod with a hostpath to /var/log you are not able to create any symlink because of SELinux:

root@escaper:~/exploit# ls /var/log/host/

My notes to "Bug 1768608 - NetworkPolicy not applied to router"

Enviroment

Baremetal OpenShift 4.2.0

$ oc version
Client Version: openshift-clients-4.3.0-201909231341
Server Version: 4.2.0
Kubernetes Version: v1.14.6+2e5ed54

Enviroment

Baremetal OpenShift 4.2.0

$ oc version
Client Version: openshift-clients-4.3.0-201909231341
Server Version: 4.2.0
Kubernetes Version: v1.14.6+2e5ed54

	[OSEv3:vars]

	openshift_hosted_registry_storage_kind=nfs
	openshift_hosted_registry_storage_access_modes=['ReadWriteMany']
	openshift_hosted_registry_storage_host=nfs.example.com
	openshift_hosted_registry_storage_nfs_directory=/exports
	openshift_hosted_registry_storage_volume_name=registry
	openshift_hosted_registry_storage_volume_size=10Gi

	openshift_master_identity_providers:
	- name: 'ad'
	challenge: true
	login: true
	mappingMethod: claim
	kind: LDAPPasswordIdentityProvider
	bindDN: "{{ dd }}"
	bindPassword: "{{ ddd }}"
	insecure: false
	url: "ldaps://ddd"

	# Add following lines to your inventory and run
	# ansible-playbook -i ~/stc/inventory playbooks/openshift-loadbalancer/config.yml
	# or ansible-playbook -i ~/stc/inventory playbooks/deploy_cluster.yml

	openshift_loadbalancer_additional_frontends=[{"name":"atomic-openshift-infra-http","mode":"tcp","options":["tcplog"],"binds":["*:80"],"default_backend":"atomic-openshift-infra-http"},{"name":"atomic-openshift-infra-https","mode"
	:"tcp","options":["tcplog"],"binds":["*:443"],"default_backend":"atomic-openshift-infra-https"}]

	openshift_loadbalancer_additional_backends=[{"name":"atomic-openshift-infra-http","mode":"tcp","option":"tcplog","balance":"roundrobin","servers":[{"name":"infra0","address":"192.168.1.110:80","opts":"check"}]},{"name":"atomic-o
	penshift-infra-https","mode":"tcp","option":"tcplog","balance":"roundrobin","servers":[{"name":"infra0","address":"192.168.1.110:443","opts":"check"}]}]

	#!/usr/bin/env ansible-playbook
	---

	- hosts: localhost
	gather_facts: false
	connection: local
	vars:
	iaas_internal_network: admin
	iaas_machine_size: m1.tiny
	iaas_image: cirros-0.4.0

	[OSEv3:children]
	masters
	nodes
	etcd

	# Set variables common for all OSEv3 hosts
	[OSEv3:vars]
	openshift_deployment_type=openshift-enterprise
	openshift_hosted_modify_imagestreams=true
	openshift_master_default_subdomain=apps.ocp3.vmw.scc.internal

	FROM kubevirt/container-disk-v1alpha
	LABEL maintainer="Robert Bohne <[email protected]>"
	ADD rhel-server-7.6-x86_64-kvm.qcow2 /disk/rhel.qcow2