Parser service account cannot get resource parsedefinitions

🐞 Bug report

Describe the bug

I am seeing the following error in my parser pod logs:

Nikto:

parsedefinitions.execution.securecodebox.io "nikto-json" is forbidden: User "system:serviceaccount:securecodebox:parser" cannot get resource "parsedefinitions" in API group "execution.securecodebox.io" in the namespace "securecodebox"

ZAP:

parsedefinitions.execution.securecodebox.io "zap-xml" is forbidden: User "system:serviceaccount:securecodebox:parser" cannot get resource "parsedefinitions" in API group "execution.securecodebox.io" in the namespace "securecodebox"

The pod will stop with exit code 1:

    State:          Terminated
      Reason:       Error
      Exit Code:    1
      Started:      Sun, 01 Oct 2023 20:32:22 +0200
      Finished:     Sun, 01 Oct 2023 20:32:24 +0200
    Ready:          False
    Restart Count:  0

Steps To Reproduce

Steps to reproduce the behavior:

Install (or upgrade?) version 4.1.0
Create a Nikto or ZAP scan
See the error in the parser pod after the scan has finished

Expected behavior

I expect SecureCodeBox to set the correct rolebindings for me, so the parser can run without errors.

Should the parser service account have the clusterrole parsedefinition-viewer-role assigned?

System (please complete the following information):

secureCodeBox Version/Release: 4.1.0
OS: Linux
Kubernetes Version: v1.24.14-gke.2700
Docker: N/A

Screenshots / Logs

Parser Pod Logs:

  body: {
    kind: 'Status',
    apiVersion: 'v1',
    metadata: {},
    status: 'Failure',
    message: 'parsedefinitions.execution.securecodebox.io "nikto-json" is forbidden: User "system:serviceaccount:securecodebox:parser" cannot get resource "parsedefinitions" in API group "execution.securecodebox.io" in the namespace "securecodebox"',
    reason: 'Forbidden',
    details: {
      name: 'nikto-json',
      group: 'execution.securecodebox.io',
      kind: 'parsedefinitions'
    },
    code: 403
  },
  statusCode: 403

Additional context

The issue started occuring after I have upgraded to SecureCodeBox 4.1.0!

I also upgraded the following CRDs to make the 4.1.0 release work:

 k apply -f https://github.com/secureCodeBox/secureCodeBox/raw/v4.1.0/operator/crds/execution.securecodebox.io_clusterparsedefinitions.yaml
 k apply -f https://github.com/secureCodeBox/secureCodeBox/raw/v4.1.0/operator/crds/execution.securecodebox.io_parsedefinitions.yaml
 k apply -f https://github.com/secureCodeBox/secureCodeBox/raw/v4.1.0/operator/crds/execution.securecodebox.io_scheduledscans.yaml

Rolebindings (k get rolebindings.rbac.authorization.k8s.io):

NAME                          ROLE                        AGE
leader-election-rolebinding   Role/leader-election-role   6d17h
lurker                        Role/lurker                 20d
parser                        Role/parser                 20d
scan-completion-hook          Role/scan-completion-hook   20d

Clusterroles (k get clusterroles.rbac.authorization.k8s.io | grep parse)

parsedefinition-editor-role                                            2023-09-27T15:34:44Z
parsedefinition-viewer-role                                            2023-09-27T15:34:44Z

@moxli

@moxli Thanks for submitting this issue. We'll investigate it.

@Ilyesbdlala

@Ilyesbdlala can you have a look at this when you find time?
i think there is a issue with the workaround with the amass fix which increase the permissions for the parser service account.

As a workaround:
The Operator will automatically recreate the ServiceAccount, Role & RoleBinding when its missing.

So as a workaround delete the resources, the operator should recreate them correctly on the next scan execution:

kubectl delete serviceaccount parser
kubectl delete role parser
kubectl delete rolebinding parser

I've hit the same problem with my local trivy and trivy-sbom scans, uninstalling the old and installing the current version of the operator and then recreating the integration-tests namespace (where my scans are running) fixed the issue for me (for now?)

#2003 Added permission to `manager-role` ClusterRole to update 'roles'

Permission to update the role went missing again in the newest release, think it was accidentally dropped when somebody was rebasing / updating their branch :(
Will open up a pr to fix this again

secureCodeBox#2003 Re-add missing roles

secureCodeBox#2003 Update helm unit-tests

secureCodeBox#2003 Re-add missing roles

#2003 Update helm unit-tests

#2003 Re-add missing roles

#2003 Update helm unit-tests

#2003 Re-add missing roles

Navigation Menu

Repository navigation

Parser service account cannot get resource parsedefinitions #2003

🐞 Bug report

Describe the bug

Steps To Reproduce

Expected behavior

System (please complete the following information):

Screenshots / Logs

Additional context

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Parser service account cannot get resource parsedefinitions #2003

Description

🐞 Bug report

Describe the bug

Steps To Reproduce

Expected behavior

System (please complete the following information):

Screenshots / Logs

Additional context

Activity

Weltraumschaf commented on Oct 4, 2023

J12934 commented on Oct 20, 2023

o1oo11oo commented on Oct 20, 2023

J12934 commented on Feb 23, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions