Skip to content

Remove the Kubernetes configuration file permissions check#13338

Merged
mattfarina merged 1 commit intohelm:mainfrom
yardenshoham:issues/13320
Oct 1, 2024
Merged

Remove the Kubernetes configuration file permissions check#13338
mattfarina merged 1 commit intohelm:mainfrom
yardenshoham:issues/13320

Conversation

@yardenshoham
Copy link
Copy Markdown
Contributor

See #13320 (comment)

What this PR does / why we need it:

We remove an out-of-scope check.

See helm#13320 (comment)

Signed-off-by: Yarden Shoham <git@yardenshoham.com>
@pull-request-size pull-request-size bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Sep 15, 2024
@gjenkins8 gjenkins8 added this to the 3.17.0 milestone Sep 16, 2024
Copy link
Copy Markdown

@sundaram2021 sundaram2021 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR correctly addresses an outdated security check that no longer aligns with modern Helm use cases. The reasoning for removal is solid, especially considering that other Kubernetes tools no longer enforce this check. By removing it, Helm avoids generating unnecessary warnings in valid deployment scenarios (e.g., mounted kubeconfig secrets).

Suggested Improvements:
Ensure documentation is updated, informing users that permissions checks are no longer enforced.
If possible, provide a note about alternative ways users can enforce security checks on kubeconfig files outside Helm.

@TerryHowe
Copy link
Copy Markdown
Contributor

i would think release notes would be enough documentation for this change.

Copy link
Copy Markdown
Contributor

@TerryHowe TerryHowe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

but IANAM

Copy link
Copy Markdown
Member

@robertsirc robertsirc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@gjenkins8 gjenkins8 added the Has One Approval This PR has one approval. It still needs a second approval to be merged. label Sep 29, 2024
Copy link
Copy Markdown
Collaborator

@mattfarina mattfarina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are a couple reasons to remove this check:

  1. When Helm is used in a container running in Kubernetes and the kubeconfig is mounted as a file via a secret you cannot control the permissions and these messages show up. This is a common enough occurance.
  2. Helm is not the creator or maintainer of this configuration file. The tools that "own" this file are not providing these messages so why should Helm?

Note, this check was added as part of a security review and was debatable at the time.

@mattfarina mattfarina merged commit 663a4e6 into helm:main Oct 1, 2024
@yardenshoham yardenshoham deleted the issues/13320 branch October 1, 2024 13:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Has One Approval This PR has one approval. It still needs a second approval to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Kubernetes configuration file is group-readable

6 participants