Skip to content

OCPSTRAT-3661: Add monitortest to verify possible Cluster Admin escalation paths #31536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
JoelSpeed wants to merge 12 commits into
base: main
Choose a base branch
from
+1,254 −0
Draft

OCPSTRAT-3661: Add monitortest to verify possible Cluster Admin escalation paths #31536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
96fc32e
Add monitortest to verify possible Cluster Admin escalation paths
JoelSpeed Aug 18, 2026
45ed22d
Ensure binding exceptions are matching role and subjects, not just name
JoelSpeed Aug 19, 2026
e742396
Add initial set of exceptions to track
JoelSpeed Aug 19, 2026
ac488c0
Restrict check to openshift and kube namespaces
JoelSpeed Aug 19, 2026
f267f31
Ensure resource names correctly accounts for ineffective restriction …
JoelSpeed Aug 21, 2026
e19a0f8
Add vSphere exception
JoelSpeed Aug 21, 2026
7e2366f
Allow approval only from architects
JoelSpeed Aug 21, 2026
d346e9d
Ensure bind to cluster-admin is flagged as an escalation path
JoelSpeed Aug 21, 2026
c0b606b
Temporarily stop producing flakes for tracked exceptions
JoelSpeed Aug 24, 2026
c223670
Ensure serviceaccounts/token create is flagged as an impersonation path
JoelSpeed Aug 25, 2026
33306e0
Always flag bind verb independent of resource names
JoelSpeed Aug 27, 2026
504cb39
Enable per check flaking to allow new checks to be added as flakes
JoelSpeed Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions pkg/defaultmonitortests/types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ import (
"github.com/openshift/origin/pkg/monitortestframework"
"github.com/openshift/origin/pkg/monitortests/authentication/legacyauthenticationmonitortests"
nodefaultserviceaccountoperatortests "github.com/openshift/origin/pkg/monitortests/authentication/nodefaultserviceaccountoperatortests"
"github.com/openshift/origin/pkg/monitortests/authentication/rbacadminescalationtests"
"github.com/openshift/origin/pkg/monitortests/authentication/requiredsccmonitortests"
admupgradestatus "github.com/openshift/origin/pkg/monitortests/cli/adm_upgrade/status"
azuremetrics "github.com/openshift/origin/pkg/monitortests/cloud/azure/metrics"
Expand Down Expand Up @@ -126,6 +127,7 @@ func newDefaultMonitorTests(info monitortestframework.MonitorTestInitializationI
// Authentication
monitorTestRegistry.AddMonitorTestOrDie("legacy-authentication-invariants", "apiserver-auth", legacyauthenticationmonitortests.NewLegacyTests())
monitorTestRegistry.AddMonitorTestOrDie("no-default-service-account-operator-checker", "oauth-apiserver", nodefaultserviceaccountoperatortests.NewAnalyzer())
monitorTestRegistry.AddMonitorTestOrDie("rbac-cluster-admin-escalation-checker", "kube-apiserver", rbacadminescalationtests.NewAnalyzer())

// Cluster Version Operator
monitorTestRegistry.AddMonitorTestOrDie("operator-state-analyzer", "Cluster Version Operator", operatorstateanalyzer.NewAnalyzer())
Expand Down
10 changes: 10 additions & 0 deletions pkg/monitortests/authentication/rbacadminescalationtests/OWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,10 @@
# See the OWNERS docs at https://go.k8s.io/owners

options:
no_parent_owners: true

approvers:
- JoelSpeed
- sdodson
- dgoodwin
- enxebre
Loading