tree d423438fbaaee1cac8728d842faae0ed0b3500a2
parent e3432ee77546c33467806bb76b99f5628705e086
author Sergiusz Bazanski <q3k@hackerspace.pl> 1589222971 +0200
committer Sergiusz Bazanski <q3k@hackerspace.pl> 1589222971 +0200

SECURITY: cluster: limit api objects modifiable by namespace admins

This previous allowed all namespace admins (ie. personal-$user namespace
users) to create any sort of obejct they wanted within that namespace.

This could've been exploited to allow creation of a RoleBinding that
would then allow to bind a serviceaccount to the insecure
podsecuritypolicy, thereby allowing escalation to root on nodes.

As far as I've checked, this hasn't been exploited, and the access to
the k8s cluster has so far also been limited to trusted users.

This has been deployed to production.

Change-Id: Icf8747d765ccfa9fed843ec9e7b0b957ff27d96e