KEP-1898keps/sig-node/1898-hardened-exec

Hardening exec endpoints against SSRF

implementablealphasig-nodelatest v1.201 open finding

KEP on GitHub kep.yaml Ask about this KEP

Mitigate the potential for privilege escalations via SSRF vulnerabilities by requiring a POST method for most exec requests, and limiting control of the executed command via URL parameters. These are breaking changes.

Facts

Authors: @tallclair
Approvers: @liggitt @derekwaynecarr
Reviewers: @sftim @liggitt @derekwaynecarr
PRR approvers: @deads2kalpha
Tracking issue: #1898(opens GitHub in a new tab) closedcompletedclosed 2021-10-08 19:18 UTCsig/nodesig/api-machinerystage/alphalifecycle/rotten
Milestones: alpha v1.20
Participating SIGs: sig-auth sig-api-machinery
Feature gates: DeprecatedKubeletStreamingAPI, HardenedExecRequests
Created / last updated: 2020-07-08 / none

Who decided each state, with the evidence.
Decided	Decision	Deciders	Evidence
2020-09-30 19:24 UTC	stage_graduation KEP-1898 set milestone.alpha to v1.20 in PR #1899, approved by derekwaynecarr; merged by automation (k8s-ci-robot) on 2020-09-30.	@tallclair author @derekwaynecarr approver @derekwaynecarr approve_command @derekwaynecarr lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@8414610d607734fc73e2fed24ec627f7f6b27f99(opens GitHub in a new tab) StatusChange milestone.alpha ∅ → v1.20 (2020-07-15)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1899 KEP: hardened exec requests(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/499718537(opens GitHub in a new tab)
2020-09-30 19:24 UTC	stage_graduation KEP-1898 graduated to alpha in PR #1899, approved by derekwaynecarr; merged by automation (k8s-ci-robot) on 2020-09-30.	@tallclair author @derekwaynecarr approver @derekwaynecarr approve_command @derekwaynecarr lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@8414610d607734fc73e2fed24ec627f7f6b27f99(opens GitHub in a new tab) StatusChange stage ∅ → alpha (2020-07-15)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1899 KEP: hardened exec requests(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/499718537
2020-09-30 19:24 UTC	status_transition KEP-1898 status set to provisional in PR #1899, approved by derekwaynecarr; merged by automation (k8s-ci-robot) on 2020-09-30.	@tallclair author @derekwaynecarr approver @derekwaynecarr approve_command @derekwaynecarr lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@8414610d607734fc73e2fed24ec627f7f6b27f99(opens GitHub in a new tab) StatusChange status ∅ → provisional (2020-07-15)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#1899 KEP: hardened exec requests(opens GitHub in a new tab) Review kubernetes/enhancements/pulls/reviews/499718537
2020-10-05 19:01 UTC	status_transition KEP-1898 status changed from provisional to implementable in PR #2062, approved by derekwaynecarr; merged by automation (k8s-ci-robot) on 2020-10-05.	@tallclair author @derekwaynecarr approve_command @derekwaynecarr lgtm @deads2k lgtm @k8s-ci-robot merger	Commit kubernetes/enhancements@7db045172047d6b51b8fd9606ca8a84786d0f183(opens GitHub in a new tab) StatusChange status provisional → implementable (2020-10-05)(opens GitHub in a new tab) PullRequest kubernetes/enhancements#2062 Hardened Exec Requests: Fill in PRR, add Kubelet feature gate, mark implementable(opens GitHub in a new tab) Comment
2022-09-27 09:36 UTC	prr_approval deads2k gave the production readiness approval for KEP-1898 at alpha on 2022-09-27.	@deads2k prr_approver	Document 1898.yaml(opens GitHub in a new tab)

Metadata, label and milestone changes, oldest first.Showing 1–10 of 30Rows

Status history
At	Kind	Field	Change	Actor	Evidence
2020-07-15 23:28 UTC	label	needs-sig added	none → needs-sig	@k8s-ci-robot	source(opens GitHub in a new tab)
2020-07-15 23:28 UTC	label	sig/node added	none → sig/node	@k8s-ci-robot	source

Relationships as stored, Person → KEP, from kep.yaml(opens GitHub in a new tab)
Person	Relationship
@tallclair GitHub(opens GitHub in a new tab)	—AUTHORED→
@sftim GitHub(opens GitHub in a new tab)	—REVIEWS→
@liggitt GitHub(opens GitHub in a new tab)	—REVIEWS→
@derekwaynecarr

2 nodes · 1 relations

KEP 2

Relations and who declared them
Relation	KEP	Status	Declared by
see also	KEP-1558 Cleaning up container streaming requests	implemented	none

How they connect

Shortest paths in the graph between this KEP and its SIG or one of its people, up to four hops.

Hardening exec endpoints against SSRF

Facts

How they connect

Impact of change

Keyboard shortcuts

Everywhere

Go to a page

Ask

Search lists

KEP page

Findings table

How they connect

Impact of change

Hop 1

Hop 2

Impact of change

Impact of change

Hop 1

Hop 2