Bug 1785201 - Don't gather pod endpoints using tokens
Summary: Don't gather pod endpoints using tokens
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: oc
Version: 4.3.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 4.3.z
Assignee: Maciej Szulik
QA Contact: zhou ying
Depends On: 1785194
TreeView+ depends on / blocked
Reported: 2019-12-19 11:27 UTC by Maciej Szulik
Modified: 2020-02-25 06:18 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of: 1785194
Last Closed: 2020-02-25 06:17:59 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift oc pull 237 0 None closed [release-4.3] Bug 1785201: don't gather pod endpoints using tokens 2020-02-24 13:34:37 UTC
Red Hat Product Errata RHBA-2020:0528 0 None None None 2020-02-25 06:18:12 UTC

Description Maciej Szulik 2019-12-19 11:27:24 UTC
+++ This bug was initially created as a clone of Bug #1785194 +++

Currently oc adm inspect will send bearer tokens when scraping data from endpoints. This might expose the tokens to potentially untrustworthy parties.

Comment 2 zhou ying 2020-02-17 02:46:42 UTC
Confirmed with latest oc client , can't reproduce the issue now: 
[root@dhcp-140-138 ~]# oc version -o yaml 
  buildDate: "2020-02-14T06:13:35Z"
  compiler: gc
  gitCommit: 1d7211968ceb449852d10d12eae92ed5c33d8b48
  gitTreeState: clean
  gitVersion: v4.3.3
  goVersion: go1.12.12
  major: ""
  minor: ""
  platform: linux/amd64

I0217 10:43:21.587619    5537 pod.go:71]         Skipping container endpoint collection for pod "kube-apiserver-ip-10-0-130-134.us-east-2.compute.internal" container "kube-apiserver": Using token authentication
I0217 10:43:21.587714    5537 pod.go:71]         Skipping container endpoint collection for pod "kube-apiserver-ip-10-0-130-134.us-east-2.compute.internal" container "kube-apiserver-cert-syncer": Using token authentication

Comment 4 errata-xmlrpc 2020-02-25 06:17:59 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.