Block Access to Other Metadata

[kylegoch]

Kube2iam has a feature to block access to the rest of the metadata from the iptables level with a simple flag: https://github.com/jtblin/kube2iam#iptables

It seems like kiam did this by accident at one point #3 and was undone. Anyway to make this optional. As we would like to block access to the metadata for our pods.

[pingles]

Thanks. We changed it so that other metadata API requests that didn't return credentials could succeed.

Perhaps it's worth reviewing the APIs and identifying which bits we'd exclude. We could certainly add a flag to exclude everything except the credential based URLs that Kiam specifically handles.

[kylegoch]

We could certainly add a flag to exclude everything except the credential based URLs that Kiam specifically handles.

This would be wonderful. We wouldnt want to force it on folks, but having that optional option would be great.

Our use case is we have pods running that we really want to restrict to only their IAM permissions, without finiding out anything about the underlying K8s nodes.

[ewbankkit]

The mux router supports regular expressions in URL paths so one solution may be to specify URL patterns that should be blocked on the command line.

[pingles]

As commented in #63 it'd be great to default to blocking everything except credentials but allow users to whitelist using regular expressions/path globs to open up APIs that cluster operators are happy with.

[pingles]

I'd love some feedback on the way @Sambooo has implemented the blocking in #110. Could @tombooth @ewbankkit and @kylegoch take a look and see what you think please?

I don't think we'll merge until the #109 PR is merged too but I'm interested in the flags/design etc.

[pingles]

This has been implemented and merged in #110 so I'm going to close this issue.

[carsonoid]

@pingles It seems that #110 was a merge into a non-master branch that has not yet made it into any upstream release. It's mentioned as a feature in the master branch README.md; but, as far as I can tell, the code hasn't actually made it to master yet. Do you have a schedule for when this feature will make it into master and a full release? Thanks!