Skip to content

Commit 39872cd

Browse files
hiddecohiddeco
authored
Merge pull request #620 from fluxcd/fssecure
2 parents ad91006 + f4528fb commit 39872cd

5 files changed

Lines changed: 58 additions & 44 deletions

File tree

‎controllers/kustomization_controller.go‎

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@ import (
5252
"sigs.k8s.io/controller-runtime/pkg/predicate"
5353
"sigs.k8s.io/controller-runtime/pkg/reconcile"
5454
"sigs.k8s.io/controller-runtime/pkg/source"
55-
"sigs.k8s.io/kustomize/kyaml/filesys"
5655

5756
apiacl "github.com/fluxcd/pkg/apis/acl"
5857
"github.com/fluxcd/pkg/apis/meta"
@@ -357,7 +356,7 @@ func (r *KustomizationReconciler) reconcile(
357356
}
358357

359358
// generate kustomization.yaml if needed
360-
err = r.generate(kustomization, dirPath)
359+
err = r.generate(kustomization, tmpDir, dirPath)
361360
if err != nil {
362361
return kustomizev1.KustomizationNotReady(
363362
kustomization,
@@ -629,8 +628,8 @@ func (r *KustomizationReconciler) getSource(ctx context.Context, kustomization k
629628
return source, nil
630629
}
631630

632-
func (r *KustomizationReconciler) generate(kustomization kustomizev1.Kustomization, dirPath string) error {
633-
gen := NewGenerator(kustomization)
631+
func (r *KustomizationReconciler) generate(kustomization kustomizev1.Kustomization, workDir string, dirPath string) error {
632+
gen := NewGenerator(workDir, kustomization)
634633
return gen.WriteFile(dirPath)
635634
}
636635

@@ -641,19 +640,17 @@ func (r *KustomizationReconciler) build(ctx context.Context, workDir string, kus
641640
}
642641
defer cleanup()
643642

644-
// import OpenPGP keys if any
643+
// Import decryption keys
645644
if err := dec.ImportKeys(ctx); err != nil {
646645
return nil, err
647646
}
648647

649-
fs := filesys.MakeFsOnDisk()
650-
// decrypt .env files before building kustomization
651-
if kustomization.Spec.Decryption != nil {
652-
if err = dec.DecryptEnvSources(dirPath); err != nil {
653-
return nil, fmt.Errorf("error decrypting .env file: %w", err)
654-
}
648+
// Decrypt Kustomize EnvSources files before build
649+
if err = dec.DecryptEnvSources(dirPath); err != nil {
650+
return nil, fmt.Errorf("error decrypting env sources: %w", err)
655651
}
656-
m, err := buildKustomization(fs, dirPath)
652+
653+
m, err := secureBuildKustomization(workDir, dirPath)
657654
if err != nil {
658655
return nil, fmt.Errorf("kustomize build failed: %w", err)
659656
}

‎controllers/kustomization_decryptor.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ func (d *KustomizeDecryptor) DecryptResource(res *resource.Resource) (*resource.
358358
// outside the working directory of the decryptor, but returns any decryption
359359
// error.
360360
func (d *KustomizeDecryptor) DecryptEnvSources(path string) error {
361-
if d.kustomization.Spec.Decryption.Provider != DecryptionProviderSOPS {
361+
if d.kustomization.Spec.Decryption == nil || d.kustomization.Spec.Decryption.Provider != DecryptionProviderSOPS {
362362
return nil
363363
}
364364

‎controllers/kustomization_generator.go‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -29,19 +29,22 @@ import (
2929
"sigs.k8s.io/kustomize/api/provider"
3030
"sigs.k8s.io/kustomize/api/resmap"
3131
kustypes "sigs.k8s.io/kustomize/api/types"
32-
"sigs.k8s.io/kustomize/kyaml/filesys"
3332
"sigs.k8s.io/yaml"
3433

35-
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
3634
"github.com/fluxcd/pkg/apis/kustomize"
35+
securefs "github.com/fluxcd/pkg/kustomize/filesys"
36+
37+
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
3738
)
3839

3940
type KustomizeGenerator struct {
41+
root string
4042
kustomization kustomizev1.Kustomization
4143
}
4244

43-
func NewGenerator(kustomization kustomizev1.Kustomization) *KustomizeGenerator {
45+
func NewGenerator(root string, kustomization kustomizev1.Kustomization) *KustomizeGenerator {
4446
return &KustomizeGenerator{
47+
root: root,
4548
kustomization: kustomization,
4649
}
4750
}
@@ -127,7 +130,10 @@ func checkKustomizeImageExists(images []kustypes.Image, imageName string) (bool,
127130
}
128131

129132
func (kg *KustomizeGenerator) generateKustomization(dirPath string) error {
130-
fs := filesys.MakeFsOnDisk()
133+
fs, err := securefs.MakeFsOnDiskSecure(kg.root)
134+
if err != nil {
135+
return err
136+
}
131137

132138
// Determine if there already is a Kustomization file at the root,
133139
// as this means we do not have to generate one.
@@ -234,11 +240,19 @@ func adaptSelector(selector *kustomize.Selector) (output *kustypes.Selector) {
234240
// TODO: remove mutex when kustomize fixes the concurrent map read/write panic
235241
var kustomizeBuildMutex sync.Mutex
236242

237-
// buildKustomization wraps krusty.MakeKustomizer with the following settings:
238-
// - load files from outside the kustomization.yaml root
239-
// - disable plugins except for the builtin ones
240-
func buildKustomization(fs filesys.FileSystem, dirPath string) (resmap.ResMap, error) {
241-
// temporary workaround for concurrent map read and map write bug
243+
// secureBuildKustomization wraps krusty.MakeKustomizer with the following settings:
244+
// - secure on-disk FS denying operations outside root
245+
// - load files from outside the kustomization dir path
246+
// (but not outside root)
247+
// - disable plugins except for the builtin ones
248+
func secureBuildKustomization(root, dirPath string) (resmap.ResMap, error) {
249+
// Create secure FS for root
250+
fs, err := securefs.MakeFsOnDiskSecure(root)
251+
if err != nil {
252+
return nil, err
253+
}
254+
255+
// Temporary workaround for concurrent map read and map write bug
242256
// https://github.com/kubernetes-sigs/kustomize/issues/3659
243257
kustomizeBuildMutex.Lock()
244258
defer kustomizeBuildMutex.Unlock()

‎go.mod‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ require (
1616
github.com/fluxcd/pkg/apis/acl v0.0.3
1717
github.com/fluxcd/pkg/apis/kustomize v0.3.2
1818
github.com/fluxcd/pkg/apis/meta v0.12.1
19+
github.com/fluxcd/pkg/kustomize v0.2.0
1920
github.com/fluxcd/pkg/runtime v0.13.3
2021
github.com/fluxcd/pkg/ssa v0.15.1
2122
github.com/fluxcd/pkg/testserver v0.2.0
@@ -29,14 +30,13 @@ require (
2930
go.mozilla.org/sops/v3 v3.7.2
3031
golang.org/x/net v0.0.0-20220225172249-27dd8689420f
3132
google.golang.org/grpc v1.45.0
32-
k8s.io/api v0.23.4
33-
k8s.io/apiextensions-apiserver v0.23.4
34-
k8s.io/apimachinery v0.23.4
35-
k8s.io/client-go v0.23.4
33+
k8s.io/api v0.23.5
34+
k8s.io/apiextensions-apiserver v0.23.5
35+
k8s.io/apimachinery v0.23.5
36+
k8s.io/client-go v0.23.5
3637
sigs.k8s.io/cli-utils v0.29.3
37-
sigs.k8s.io/controller-runtime v0.11.1
38+
sigs.k8s.io/controller-runtime v0.11.2
3839
sigs.k8s.io/kustomize/api v0.11.4
39-
sigs.k8s.io/kustomize/kyaml v0.13.6
4040
sigs.k8s.io/yaml v1.3.0
4141
)
4242

@@ -199,11 +199,12 @@ require (
199199
gopkg.in/yaml.v2 v2.4.0 // indirect
200200
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
201201
k8s.io/cli-runtime v0.23.2 // indirect
202-
k8s.io/component-base v0.23.4 // indirect
202+
k8s.io/component-base v0.23.5 // indirect
203203
k8s.io/klog/v2 v2.50.0 // indirect
204204
k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
205205
k8s.io/kubectl v0.23.2 // indirect
206206
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9 // indirect
207207
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
208+
sigs.k8s.io/kustomize/kyaml v0.13.6 // indirect
208209
sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
209210
)

‎go.sum‎

Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -276,6 +276,8 @@ github.com/fluxcd/pkg/apis/kustomize v0.3.2 h1:ULoAwOOekHf5cy6mYIwL+K6v8/cfcNVVb
276276
github.com/fluxcd/pkg/apis/kustomize v0.3.2/go.mod h1:p8iAH5TeqMBnnxkkpCNNDvWYfKlNRx89a6WKOo+hJHA=
277277
github.com/fluxcd/pkg/apis/meta v0.12.1 h1:m5PfKAqbqWBvGp9+JRj1sv+xNkGsHwUVf+3rJ8wm6SE=
278278
github.com/fluxcd/pkg/apis/meta v0.12.1/go.mod h1:f8YVt70/KAhqzZ7xxhjvqyzKubOYx2pAbakb/FfCEg8=
279+
github.com/fluxcd/pkg/kustomize v0.2.0 h1:twiGAFJctt2tyH8vHxL1uqb6BlU3B9ZqG8uSlluuioM=
280+
github.com/fluxcd/pkg/kustomize v0.2.0/go.mod h1:Qczvl7vNY9NJBpyaFrldsxfGjj6uaMcMmKGsSJ6hcxc=
279281
github.com/fluxcd/pkg/runtime v0.13.3 h1:k0Xun+RoEC/F6iuAPTA6rQb+I4B4oecBx6pOcodX11A=
280282
github.com/fluxcd/pkg/runtime v0.13.3/go.mod h1:dzWNKqFzFXeittbpFcJzR3cdC9CWlbzw+pNOgaVvF/0=
281283
github.com/fluxcd/pkg/ssa v0.15.1 h1:HXAT+K6c9Yy8Evxdyk3DU0KTk3yZ+fwgTEEzU1W/1V8=
@@ -1440,24 +1442,24 @@ honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt
14401442
honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
14411443
honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
14421444
k8s.io/api v0.23.2/go.mod h1:sYuDb3flCtRPI8ghn6qFrcK5ZBu2mhbElxRE95qpwlI=
1443-
k8s.io/api v0.23.4 h1:85gnfXQOWbJa1SiWGpE9EEtHs0UVvDyIsSMpEtl2D4E=
1444-
k8s.io/api v0.23.4/go.mod h1:i77F4JfyNNrhOjZF7OwwNJS5Y1S9dpwvb9iYRYRczfI=
1445-
k8s.io/apiextensions-apiserver v0.23.4 h1:AFDUEu/yEf0YnuZhqhIFhPLPhhcQQVuR1u3WCh0rveU=
1446-
k8s.io/apiextensions-apiserver v0.23.4/go.mod h1:TWYAKymJx7nLMxWCgWm2RYGXHrGlVZnxIlGnvtfYu+g=
1445+
k8s.io/api v0.23.5 h1:zno3LUiMubxD/V1Zw3ijyKO3wxrhbUF1Ck+VjBvfaoA=
1446+
k8s.io/api v0.23.5/go.mod h1:Na4XuKng8PXJ2JsploYYrivXrINeTaycCGcYgF91Xm8=
1447+
k8s.io/apiextensions-apiserver v0.23.5 h1:5SKzdXyvIJKu+zbfPc3kCbWpbxi+O+zdmAJBm26UJqI=
1448+
k8s.io/apiextensions-apiserver v0.23.5/go.mod h1:ntcPWNXS8ZPKN+zTXuzYMeg731CP0heCTl6gYBxLcuQ=
14471449
k8s.io/apimachinery v0.23.2/go.mod h1:zDqeV0AK62LbCI0CI7KbWCAYdLg+E+8UXJ0rIz5gmS8=
1448-
k8s.io/apimachinery v0.23.4 h1:fhnuMd/xUL3Cjfl64j5ULKZ1/J9n8NuQEgNL+WXWfdM=
1449-
k8s.io/apimachinery v0.23.4/go.mod h1:BEuFMMBaIbcOqVIJqNZJXGFTP4W6AycEpb5+m/97hrM=
1450-
k8s.io/apiserver v0.23.4/go.mod h1:A6l/ZcNtxGfPSqbFDoxxOjEjSKBaQmE+UTveOmMkpNc=
1450+
k8s.io/apimachinery v0.23.5 h1:Va7dwhp8wgkUPWsEXk6XglXWU4IKYLKNlv8VkX7SDM0=
1451+
k8s.io/apimachinery v0.23.5/go.mod h1:BEuFMMBaIbcOqVIJqNZJXGFTP4W6AycEpb5+m/97hrM=
1452+
k8s.io/apiserver v0.23.5/go.mod h1:7wvMtGJ42VRxzgVI7jkbKvMbuCbVbgsWFT7RyXiRNTw=
14511453
k8s.io/cli-runtime v0.23.2 h1:4zOZX78mFSakwe4gef81XDBu94Yu0th6bfveTOx8ZQk=
14521454
k8s.io/cli-runtime v0.23.2/go.mod h1:Ag70akCDvwux4HxY+nH2J3UqE2e6iwSSdG1HE6p1VTU=
14531455
k8s.io/client-go v0.23.2/go.mod h1:k3YbsWg6GWdHF1THHTQP88X9RhB1DWPo3Dq7KfU/D1c=
1454-
k8s.io/client-go v0.23.4 h1:YVWvPeerA2gpUudLelvsolzH7c2sFoXXR5wM/sWqNFU=
1455-
k8s.io/client-go v0.23.4/go.mod h1:PKnIL4pqLuvYUK1WU7RLTMYKPiIh7MYShLshtRY9cj0=
1456+
k8s.io/client-go v0.23.5 h1:zUXHmEuqx0RY4+CsnkOn5l0GU+skkRXKGJrhmE2SLd8=
1457+
k8s.io/client-go v0.23.5/go.mod h1:flkeinTO1CirYgzMPRWxUCnV0G4Fbu2vLhYCObnt/r4=
14561458
k8s.io/code-generator v0.23.2/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
1457-
k8s.io/code-generator v0.23.4/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
1459+
k8s.io/code-generator v0.23.5/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
14581460
k8s.io/component-base v0.23.2/go.mod h1:wS9Z03MO3oJ0RU8bB/dbXTiluGju+SC/F5i660gxB8c=
1459-
k8s.io/component-base v0.23.4 h1:SziYh48+QKxK+ykJ3Ejqd98XdZIseVBG7sBaNLPqy6M=
1460-
k8s.io/component-base v0.23.4/go.mod h1:8o3Gg8i2vnUXGPOwciiYlkSaZT+p+7gA9Scoz8y4W4E=
1461+
k8s.io/component-base v0.23.5 h1:8qgP5R6jG1BBSXmRYW+dsmitIrpk8F/fPEvgDenMCCE=
1462+
k8s.io/component-base v0.23.5/go.mod h1:c5Nq44KZyt1aLl0IpHX82fhsn84Sb0jjzwjpcA42bY0=
14611463
k8s.io/component-helpers v0.23.2/go.mod h1:J6CMwiaf0izLoNwiLl2OymB4+rGTsTpWp6PL/AqOM4U=
14621464
k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
14631465
k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
@@ -1480,11 +1482,11 @@ k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
14801482
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
14811483
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
14821484
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
1483-
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.27/go.mod h1:tq2nT0Kx7W+/f2JVE+zxYtUhdjuELJkVpNz+x/QN5R4=
1485+
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.30/go.mod h1:fEO7lRTdivWO2qYVCVG7dEADOMo/MLDCVr8So2g88Uw=
14841486
sigs.k8s.io/cli-utils v0.29.3 h1:4QRB9ayCd5pd9M/D3q2KQgr+nYrvRaw3suW+rcOutvk=
14851487
sigs.k8s.io/cli-utils v0.29.3/go.mod h1:WDVRa5/eQBKntG++uyKdyT+xU7MLdCR4XsgseqL5uX4=
1486-
sigs.k8s.io/controller-runtime v0.11.1 h1:7YIHT2QnHJArj/dk9aUkYhfqfK5cIxPOX5gPECfdZLU=
1487-
sigs.k8s.io/controller-runtime v0.11.1/go.mod h1:KKwLiTooNGu+JmLZGn9Sl3Gjmfj66eMbCQznLP5zcqA=
1488+
sigs.k8s.io/controller-runtime v0.11.2 h1:H5GTxQl0Mc9UjRJhORusqfJCIjBO8UtUxGggCwL1rLA=
1489+
sigs.k8s.io/controller-runtime v0.11.2/go.mod h1:P6QCzrEjLaZGqHsfd+os7JQ+WFZhvB8MRFsn4dWF7O4=
14881490
sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
14891491
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 h1:kDi4JBNAsJWfz1aEXhO8Jg87JJaPNLh5tIzYHgStQ9Y=
14901492
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2/go.mod h1:B+TnT182UBxE84DiCz4CVE26eOSDAeYCpfDnC2kdKMY=

0 commit comments

Comments
 (0)
⚡