cert-manager: 1.20.3 -> 1.21.0
Change-Id: I50161b8cfd621c1b07de87358fe8c14d1b14f711
diff --git a/charts/cert-manager/templates/rbac.yaml b/charts/cert-manager/templates/rbac.yaml
index e1a01b9..4910e72 100644
--- a/charts/cert-manager/templates/rbac.yaml
+++ b/charts/cert-manager/templates/rbac.yaml
@@ -45,50 +45,6 @@
---
-{{- if .Values.serviceAccount.create }}
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
- name: {{ template "cert-manager.fullname" . }}-tokenrequest
- namespace: {{ include "cert-manager.namespace" . }}
- labels:
- app: {{ include "cert-manager.name" . }}
- app.kubernetes.io/name: {{ include "cert-manager.name" . }}
- app.kubernetes.io/instance: {{ .Release.Name }}
- app.kubernetes.io/component: "controller"
- {{- include "labels" . | nindent 4 }}
-rules:
- - apiGroups: [""]
- resources: ["serviceaccounts/token"]
- resourceNames: ["{{ template "cert-manager.serviceAccountName" . }}"]
- verbs: ["create"]
-
----
-
-# grant cert-manager permission to create tokens for the serviceaccount
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
- name: {{ include "cert-manager.fullname" . }}-tokenrequest
- namespace: {{ include "cert-manager.namespace" . }}
- labels:
- app: {{ include "cert-manager.name" . }}
- app.kubernetes.io/name: {{ include "cert-manager.name" . }}
- app.kubernetes.io/instance: {{ .Release.Name }}
- app.kubernetes.io/component: "controller"
- {{- include "labels" . | nindent 4 }}
-roleRef:
- apiGroup: rbac.authorization.k8s.io
- kind: Role
- name: {{ template "cert-manager.fullname" . }}-tokenrequest
-subjects:
- - kind: ServiceAccount
- name: {{ template "cert-manager.serviceAccountName" . }}
- namespace: {{ include "cert-manager.namespace" . }}
-{{- end }}
-
----
-
# Issuer controller role
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
@@ -515,15 +471,21 @@
resources: ["certificates/status"]
verbs: ["update"]
{{- /*
- Challenge and Order resources are not intended to be created or
- modified directly by users.
+ Challenge and Order resources are not intended to be created by users
+ (GHSA-8rvj-mm4h-c258).
- Challenges: "create" is excluded. "patch" and "update" are retained
- because spec is immutable after creation (ValidateChallengeUpdate)
- and because users need them to remove stuck finalizers
+ Challenges: "create" is excluded because a user-created Challenge with
+ attacker-controlled spec.solver can exfiltrate ClusterIssuer credentials
+ cross-namespace. "patch" and "update" are retained because spec is
+ immutable after creation (ValidateChallengeUpdate) so they cannot change
+ solver config, and because users need them to remove stuck finalizers
(see cert-manager/cert-manager#3851, cert-manager/cert-manager#3870).
- Orders: "create", "patch", and "update" are excluded.
+ Orders: "create", "patch", and "update" are excluded because a user
+ who can update an Order can change spec.issuerRef to reference a
+ different ClusterIssuer, then delete the Challenge; the Orders
+ controller recreates the Challenge with the attacker-chosen Issuer's
+ solver config, exfiltrating its credentials.
*/}}
- apiGroups: ["acme.cert-manager.io"]
resources: ["challenges"]