Mitigate automountServiceAccountToken findings in Argo
General MR
Summary
Closes #1827
This MR leverages the mutating Kyverno policy named update-automountserviceaccounttokens to harden all ServiceAccounts in the argocd namespace/package, and to place Pod exceptions where applicable (depending if the application truly needs access to the K8s API).
Justification for Pod exceptions are placed in comments alongside the code.
Manual testing according to the packages' DEVELOPMENT_MAINTENANCE.md has shown no loss of functionality. Pipeline tests are passing.
Merge request reports
Activity
changed milestone to %2.16.0
added argocd kindenhancement priority7 statusdoing labels
assigned to @justen.mehl
added 7 commits
-
362321cf...c16f6411 - 6 commits from branch
master - 55f95c41 - harden argo
-
362321cf...c16f6411 - 6 commits from branch
mentioned in merge request big-bang/product/packages/argocd!190 (merged)
added 13 commits
-
587a7c1f...a25971dc - 10 commits from branch
master - d14d6039 - harden argo
- 6dbb9b16 - harden default SA
- b55d3a2e - fix SA typo
Toggle commit list-
587a7c1f...a25971dc - 10 commits from branch
added statusreview label and removed statusdoing label
requested review from @michaelmartin, @ryan.j.garcia, @ryan.thompson.44, and @chris.oconnell
@rgsjustins @andrewshoell : You have been tagged in this merge request for the purpose of conducting secondary review.
Resolved by Justen MehlAny thoughts on using a wildcard in the service account names? I feel like this will break anytime an arcod upstream service account name changes, or if a new SA is added we won't be tracking that
- Last reply by Justen Mehl
added 18 commits
-
b55d3a2e...a2b29c76 - 16 commits from branch
master - 0bdb9f94 - harden argo
- 15b99875 - fix SA typo
-
b55d3a2e...a2b29c76 - 16 commits from branch
added statusdoing label and removed statusreview label
changed milestone to %2.17.0
removed review request for @ryan.j.garcia, @ryan.thompson.44, @michaelmartin, and @chris.oconnell