[go: nahoru, domu]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Api Server hunting: Not creating pod when no permissions to list namespaces #282

Open
iyehuda opened this issue Dec 3, 2019 · 1 comment
Open

Api Server hunting: Not creating pod when no permissions to list namespaces #282

iyehuda opened this issue Dec 3, 2019 · 1 comment
Labels
bug Something isn't working
Milestone
v0.4.2

Comments

@iyehuda
Copy link
Contributor
iyehuda commented Dec 3, 2019

What happened

Started kube-hunter in active mode with RBAC rules enabled for pod creation.
kube-hunter did not report about successful pod creation.

Expected behavior

kube-hunter reports about successful pod creation
@iyehuda iyehuda added the bug Something isn't working label Dec 3, 2019
@iyehuda
Copy link
Contributor Author
iyehuda commented Dec 3, 2019

It worked when added ClusterRole for listing namespaces.
The logic behind the hunter is to list namespaces and try to create a pod inside every namespace found.
When there is no access to list namespaces, the hunter will not try to create a pod.
The desired behavior is to create a pod inside the service account namespace when no namespaces discovered.

@danielsagi danielsagi changed the title API server access tests are skipped Api Server hunting: Not creating pod when no permissions to list namespaces Nov 28, 2020
@danielsagi danielsagi added this to the v0.4.1 milestone Nov 28, 2020
@danielsagi danielsagi modified the milestones: v0.4.1, v0.4.2 Dec 17, 2020
py-go pushed a commit to py-go/kube-hunter that referenced this issue Aug 29, 2021
@danielpacak
feat(trivy): Authenticate Trivy client with token and custom headers (a…
bc06a15 
…quasecurity#282)

Resolves: aquasecurity#248 aquasecurity#249

Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
v0.4.2
Development

No branches or pull requests
2 participants
@iyehuda @danielsagi