← 输入框|github.com|刷新
Skip to content

AutoDiscovery serviceaccount lacks permissions: User auto-discovery cannot delete resource "scheduledscans" in API group #2680

New issue
New issue
Closed
Closed
AutoDiscovery serviceaccount lacks permissions: User auto-discovery cannot delete resource "scheduledscans" in API group#2680
Assignees
BorisShek
Labels
bugBugs

Description

@LittaKake
LittaKake
opened on Sep 26, 2024

🐞 Bug report

Describe the bug

When a pod is deleted the scheduledscan related to it is not properly deleted.

Steps To Reproduce

  1. kind create cluster --name xxx
  2. Install securecodebox operator helm --namespace securecodebox-system upgrade --install --create-namespace securecodebox-operator oci://ghcr.io/securecodebox/helm/operator
  3. Install autodiscovery helm install --namespace securecodebox-system auto-discovery-kubernetes oci://ghcr.io/securecodebox/helm/auto-discovery-kubernetes --values values.yaml

Values can be seen here

config:
  resourceInclusion:
    mode: "enabled-per-namespace"
  serviceAutoDiscovery:
    enabled: false
  containerAutoDiscovery:
    enabled: true
    scanConfigs:
    - annotations:
        defectdojo.securecodebox.io/engagement-name: "{{ .Target.Name }}"
        defectdojo.securecodebox.io/engagement-version: "{{if (index .Target.Labels
          `app.kubernetes.io/version`) }}{{ index .Target.Labels `app.kubernetes.io/version`
          }}{{end}}"
        defectdojo.securecodebox.io/product-name: "{{ .Cluster.Name }} | {{ .Namespace.Name
          }} | {{ .Target.Name }}"
        defectdojo.securecodebox.io/product-tags: cluster/{{ .Cluster.Name }},namespace/{{
          .Namespace.Name }}
      env: []
      hookSelector: {}
      labels: {}
      name: trivy
      parameters:
      - "{{ .ImageID }}"
      repeatInterval: 168h
      scanType: trivy-sbom-image
      volumeMounts: []
      volumes: []
  1. Create new ns k create ns trivy-test
  2. Install scanner in namespace helm upgrade --namespace trivy-test --install trivy-sbom oci://ghcr.io/securecodebox/helm/trivy-sbom
  3. Annotate namespace k annotate ns trivy-test auto-discovery.securecodebox.io/enabled=true
  4. Create pod k run nginx --image nginx -n trivy-test
  5. Delete pod k delete pod/nginx -n trivy-test

Expected behavior

Garbage collection should be able to delete the scheduledscans, scans, etc.

System (please complete the following information):

  • secureCodeBox 4.7.0
  • OS: macOS 14.3.1
  • Kubernetes Version v1.30.2
  • Docker Version 25.0.3
  • Browser chrome

Screenshots / Logs

k logs pod/auto...

	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:222
2024-09-26T09:43:01Z	ERROR	controllers.ContainerScanController	Unable to delete scheduled scan	{"scan": "nginx-trivy-at-04ba374043ccd2fc5c593885c0eacddebabd5ca375f9323", "error": "scheduledscans.execution.securecodebox.io \"nginx-trivy-at-04ba374043ccd2fc5c593885c0eacddebabd5ca375f9323\" is forbidden: User \"system:serviceaccount:securecodebox-system:auto-discovery\" cannot delete resource \"scheduledscans\" in API group \"execution.securecodebox.io\" in the namespace \"app-ws-iris-workstation\""}
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).deleteScans
	/workspace/controllers/container_scan_controller.go:468
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).checkIfScansNeedToBeDeleted
	/workspace/controllers/container_scan_controller.go:407
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).Reconcile
	/workspace/controllers/container_scan_controller.go:84
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:222
2024-09-26T09:43:01Z	ERROR	controllers.ContainerScanController	Unable to delete scheduled scan	{"scan": "nginx-trivy-at-04ba374043ccd2fc5c593885c0eacddebabd5ca375f9323", "error": "scheduledscans.execution.securecodebox.io \"nginx-trivy-at-04ba374043ccd2fc5c593885c0eacddebabd5ca375f9323\" is forbidden: User \"system:serviceaccount:securecodebox-system:auto-discovery\" cannot delete resource \"scheduledscans\" in API group \"execution.securecodebox.io\" in the namespace \"app-ws-iris-workstation\""}
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).deleteScans
	/workspace/controllers/container_scan_controller.go:468
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).checkIfScansNeedToBeDeleted
	/workspace/controllers/container_scan_controller.go:407
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).Reconcile
	/workspace/controllers/container_scan_controller.go:84
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:222
2024-09-26T09:43:01Z	ERROR	controllers.ContainerScanController	Unable to delete scheduled scan	{"scan": "nginx-trivy-at-04ba374043ccd2fc5c593885c0eacddebabd5ca375f9323", "error": "scheduledscans.execution.securecodebox.io \"nginx-trivy-at-04ba374043ccd2fc5c593885c0eacddebabd5ca375f9323\" is forbidden: User \"system:serviceaccount:securecodebox-system:auto-discovery\" cannot delete resource \"scheduledscans\" in API group \"execution.securecodebox.io\" in the namespace \"app-ws-iris-workstation\""}
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).deleteScans
	/workspace/controllers/container_scan_controller.go:468
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).checkIfScansNeedToBeDeleted
	/workspace/controllers/container_scan_controller.go:407
github.com/secureCodeBox/secureCodeBox/auto-discovery/kubernetes/controllers.(*ContainerScanReconciler).Reconcile
	/workspace/controllers/container_scan_controller.go:84
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Reconcile
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:114
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:311
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:261
sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).Start.func2.2
	/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.18.2/pkg/internal/controller/controller.go:222

Additional context

Activity

  1. LittaKake
    added
    bugBugs
    on Sep 26, 2024

  2. LittaKake commented on Sep 26, 2024

    @LittaKake
    LittaKake
    on Sep 26, 2024
    Author

    My guess would be to add "delete" here

    secureCodeBox/auto-discovery/kubernetes/templates/rbac/role.yaml

    Line 58 in 2a80c31

    verbs:

  3. J12934 commented on Sep 26, 2024

    @J12934
    J12934
    on Sep 26, 2024
    Member

    Hi @DiiBBz

    Thanks you for the report 👍
    Was just wondering last week why a scan didn't get cleared up but hadn't had time to investigate this yet 🙌

    That seems to be missing indeed.

    The role file should be auto generated from the kubebuilder annotation in the controller go code: https://github.com/secureCodeBox/secureCodeBox/blob/main/auto-discovery/kubernetes/controllers/container_scan_controller.go#L49

    These seem to be mostly missing for the container one but are present for the service autodiscovery, ideally both files should list the permissions they need each. Kubebuilder will then generate the combined roles from them both.

  4. J12934
    added this to secureCodeBoxon Sep 26, 2024
  5. github-project-automation
    moved this to Backlog in secureCodeBoxon Sep 26, 2024
  6. J12934
    moved this from Backlog to Todo in secureCodeBoxon Sep 26, 2024
  7. BorisShek
    moved this from Todo to In Progress in secureCodeBoxon Jan 21, 2025
  8. BorisShek
    self-assigned this
    on Jan 21, 2025
  9. BorisShek
    added 4 commits that reference this issue on Jan 27, 2025

    secureCodeBox#2680 Grant delete permissions for scheduled scans in au…

    ab50c08

    secureCodeBox#2680 Grant delete permissions for scheduled scans in au…

    6d3b786

    secureCodeBox#2680 Update auto-discovery tests snapshot

    6c9d08a

    secureCodeBox#2680 Handle missing ScheduledScan gracefully by auto-di…

    ccb82e7
  10. J12934
    added 3 commits that reference this issue on Jan 28, 2025

    #2680 Grant delete permissions for scheduled scans in auto-discovery

    eadb4f3

    #2680 Update auto-discovery tests snapshot

    a2ebbae

    #2680 Handle missing ScheduledScan gracefully by auto-discovery

    2ff9acc
  11. BorisShek
    moved this from In Progress to Reviewer Approved in secureCodeBoxon Jan 30, 2025
  12. BorisShek
    moved this from Reviewer Approved to In Progress in secureCodeBoxon Jan 30, 2025
  13. BorisShek
    moved this from In Progress to Reviewer Approved in secureCodeBoxon Jan 30, 2025

  14. J12934 commented on Feb 3, 2025

    @J12934
    J12934
    on Feb 3, 2025
    Member

    Will be fixed in the next release :)
    Closing this now.
    Thanks again for reporting this 🙌

  15. J12934
    closed this as completedon Feb 3, 2025
  16. github-project-automation
    moved this from Reviewer Approved to Done in secureCodeBoxon Feb 3, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugBugs

Type

No type

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions