Agent private key permissions are too permissive

[Jimvin]

The permissions on /etc/stackable/stackable-agent/secret are world readable. Any user is able to read the secret key.

[root@stackable log]# ls -l /etc/stackable/stackable-agent/secret
total 8
-rw-r--r--. 1 root root 684 Jul  8 15:24 agent.crt
-rw-r--r--. 1 root root 246 Jul  8 15:24 agent.key

[lfrancke]

This issue has two parts:

1. Fix permissions on creation time in krustlet.

2. Additionally we'd like to make sure that the whole secret directory is locked down as much as possible.

[soenkeliebau]

I opened krustlet/krustlet#639 for this.

[siegfriedweber]

1. Fix permissions on creation time in krustlet.

Pull request created: krustlet/krustlet#647

2. Additionally we'd like to make sure that the whole secret directory is locked down as much as possible.

On k3s and on the NixOS Kubernetes cluster, the secret directory is world-accessible. Only the key files are restricted:

$ ls -l /var/lib/kubernetes/secrets/
total 132
lrwxrwxrwx 1 root       root      30 Jul 22 08:34 apitoken.secret -> /var/lib/cfssl/apitoken.secret
-rw-r--r-- 1 root       nogroup 1257 Jun 30 18:44 ca.pem
-rw------- 1 root       nogroup 1675 Jun 30 18:44 cluster-admin-key.pem
-rw-r--r-- 1 root       root    1289 Jun 30 18:44 cluster-admin.pem
-rw------- 1 etcd       nogroup 1679 Jun 30 18:44 etcd-key.pem
-rw-r--r-- 1 root       root    1310 Jun 30 18:44 etcd.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 flannel-client-key.pem
-rw-r--r-- 1 root       root    1257 Jun 30 18:44 flannel-client.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kube-addon-manager-key.pem
-rw-r--r-- 1 root       root    1289 Jun 30 18:44 kube-addon-manager.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kube-apiserver-etcd-client-key.pem
-rw-r--r-- 1 root       root    1249 Jun 30 18:44 kube-apiserver-etcd-client.pem
-rw------- 1 kubernetes nogroup 1675 Jun 30 18:44 kube-apiserver-key.pem
-rw------- 1 kubernetes nogroup 1675 Jun 30 18:44 kube-apiserver-kubelet-client-key.pem
-rw-r--r-- 1 root       root    1281 Jun 30 18:44 kube-apiserver-kubelet-client.pem
-rw-r--r-- 1 root       root    1367 Jun 30 18:44 kube-apiserver.pem
-rw------- 1 kubernetes nogroup 1675 Jun 30 18:44 kube-apiserver-proxy-client-key.pem
-rw-r--r-- 1 root       root    1269 Jun 30 18:44 kube-apiserver-proxy-client.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kube-controller-manager-client-key.pem
-rw-r--r-- 1 root       root    1306 Jun 30 18:44 kube-controller-manager-client.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kube-controller-manager-key.pem
-rw-r--r-- 1 root       root    1285 Jun 30 18:44 kube-controller-manager.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kubelet-client-key.pem
-rw-r--r-- 1 root       root    1318 Jun 30 18:44 kubelet-client.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kubelet-key.pem
-rw-r--r-- 1 root       root    1253 Jun 30 18:44 kubelet.pem
-rw------- 1 kubernetes nogroup 1679 Jun 30 18:44 kube-proxy-client-key.pem
-rw-r--r-- 1 root       root    1265 Jun 30 18:44 kube-proxy-client.pem
-rw------- 1 kubernetes nogroup 1675 Jun 30 18:44 kube-scheduler-client-key.pem
-rw-r--r-- 1 root       root    1281 Jun 30 18:44 kube-scheduler-client.pem
-rw------- 1 kubernetes nogroup 1675 Jun 30 18:44 service-account-key.pem
-rw-r--r-- 1 root       root    1302 Jun 30 18:44 service-account.pem

Therefore I would vote now, not to restrict the access to this directory.