Skip to content

Commit

Permalink
Remove serviceaccount for game server container
Browse files Browse the repository at this point in the history 
This mounts an emptydir over the service account token
that is automatically mounted in the container that runs
the game server binary.

Since this is exposed to the outside world, removing the serviceaccount
token removes authentication against the rest of the Kubernetes cluster
if it ever gets compromised.

Closes googleforgames#150
  • Loading branch information
@markmandel
markmandel committed Mar 7, 2019
1 parent 9bdaba0 commit 44142cf
Show file tree
Hide file tree
Showing 4 changed files with 64 additions and 55 deletions.
113 changes: 60 additions & 53 deletions cmd/controller/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,24 +52,25 @@ import (
)

const (
enableStackdriverMetricsFlag = "stackdriver-exporter"
enablePrometheusMetricsFlag = "prometheus-exporter"
projectIDFlag = "gcp-project-id"
sidecarImageFlag = "sidecar-image"
sidecarCPURequestFlag = "sidecar-cpu-request"
sidecarCPULimitFlag = "sidecar-cpu-limit"
pullSidecarFlag = "always-pull-sidecar"
minPortFlag = "min-port"
maxPortFlag = "max-port"
certFileFlag = "cert-file"
keyFileFlag = "key-file"
numWorkersFlag = "num-workers"
apiServerSustainedQPSFlag = "api-server-qps"
apiServerBurstQPSFlag = "api-server-qps-burst"
logDirFlag = "log-dir"
logSizeLimitMBFlag = "log-size-limit-mb"
kubeconfigFlag = "kubeconfig"
defaultResync = 30 * time.Second
enableStackdriverMetricsFlag = "stackdriver-exporter"
enablePrometheusMetricsFlag = "prometheus-exporter"
projectIDFlag = "gcp-project-id"
sidecarImageFlag = "sidecar-image"
sidecarCPURequestFlag = "sidecar-cpu-request"
sidecarCPULimitFlag = "sidecar-cpu-limit"
pullSidecarFlag = "always-pull-sidecar"
minPortFlag = "min-port"
maxPortFlag = "max-port"
certFileFlag = "cert-file"
keyFileFlag = "key-file"
numWorkersFlag = "num-workers"
apiServerSustainedQPSFlag = "api-server-qps"
apiServerBurstQPSFlag = "api-server-qps-burst"
logDirFlag = "log-dir"
logSizeLimitMBFlag = "log-size-limit-mb"
disableGameServerContainerServiceAccountFlag = "disable-gameserver-service-account"
kubeconfigFlag = "kubeconfig"
defaultResync = 30 * time.Second
// topNGSForAllocation is used by the GameServerAllocation controller
// to reduce the contention while allocating gameservers.
topNGSForAllocation = 100
Expand Down Expand Up @@ -183,7 +184,7 @@ func main() {

gsController := gameservers.NewController(wh, health,
ctlConf.MinPort, ctlConf.MaxPort, ctlConf.SidecarImage, ctlConf.AlwaysPullSidecar,
ctlConf.SidecarCPURequest, ctlConf.SidecarCPULimit,
ctlConf.SidecarCPURequest, ctlConf.SidecarCPULimit, ctlConf.DisableGameServerContainerServiceAccount,
kubeClient, kubeInformerFactory, extClient, agonesClient, agonesInformerFactory)
gsSetController := gameserversets.NewController(wh, health,
kubeClient, extClient, agonesClient, agonesInformerFactory)
Expand Down Expand Up @@ -236,6 +237,7 @@ func parseEnvFlags() config {
viper.SetDefault(apiServerBurstQPSFlag, 200)
viper.SetDefault(logDirFlag, "")
viper.SetDefault(logSizeLimitMBFlag, 10000) // 10 GB, will be split into 100 MB chunks
viper.SetDefault(disableGameServerContainerServiceAccountFlag, true)

pflag.String(sidecarImageFlag, viper.GetString(sidecarImageFlag), "Flag to overwrite the GameServer sidecar image that is used. Can also use SIDECAR env variable")
pflag.String(sidecarCPULimitFlag, viper.GetString(sidecarCPULimitFlag), "Flag to overwrite the GameServer sidecar container's cpu limit. Can also use SIDECAR_CPU_LIMIT env variable")
Expand All @@ -254,6 +256,8 @@ func parseEnvFlags() config {
pflag.Int32(apiServerBurstQPSFlag, 200, "Maximum burst queries per second to send to the API server")
pflag.String(logDirFlag, viper.GetString(logDirFlag), "If set, store logs in a given directory.")
pflag.Int32(logSizeLimitMBFlag, 1000, "Log file size limit in MB")
pflag.Bool(disableGameServerContainerServiceAccountFlag, viper.GetBool(disableGameServerContainerServiceAccountFlag), "When enabled, mounts an `emptyDir` over the service account token in the GameServer container, to stop game server processes from accessing Kubernetes. Can also use env DISABLE_GAMESERVER_SERVICE_ACCOUNT")

pflag.Parse()

viper.SetEnvKeyReplacer(strings.NewReplacer("-", "_"))
Expand All @@ -275,6 +279,7 @@ func parseEnvFlags() config {
runtime.Must(viper.BindEnv(apiServerBurstQPSFlag))
runtime.Must(viper.BindEnv(logDirFlag))
runtime.Must(viper.BindEnv(logSizeLimitMBFlag))
runtime.Must(viper.BindEnv(disableGameServerContainerServiceAccountFlag))

request, err := resource.ParseQuantity(viper.GetString(sidecarCPURequestFlag))
if err != nil {
Expand All @@ -287,45 +292,47 @@ func parseEnvFlags() config {
}

return config{
MinPort: int32(viper.GetInt64(minPortFlag)),
MaxPort: int32(viper.GetInt64(maxPortFlag)),
SidecarImage: viper.GetString(sidecarImageFlag),
SidecarCPURequest: request,
SidecarCPULimit: limit,
AlwaysPullSidecar: viper.GetBool(pullSidecarFlag),
KeyFile: viper.GetString(keyFileFlag),
CertFile: viper.GetString(certFileFlag),
KubeConfig: viper.GetString(kubeconfigFlag),
PrometheusMetrics: viper.GetBool(enablePrometheusMetricsFlag),
Stackdriver: viper.GetBool(enableStackdriverMetricsFlag),
GCPProjectID: viper.GetString(projectIDFlag),
NumWorkers: int(viper.GetInt32(numWorkersFlag)),
APIServerSustainedQPS: int(viper.GetInt32(apiServerSustainedQPSFlag)),
APIServerBurstQPS: int(viper.GetInt32(apiServerBurstQPSFlag)),
LogDir: viper.GetString(logDirFlag),
LogSizeLimitMB: int(viper.GetInt32(logSizeLimitMBFlag)),
MinPort: int32(viper.GetInt64(minPortFlag)),
MaxPort: int32(viper.GetInt64(maxPortFlag)),
SidecarImage: viper.GetString(sidecarImageFlag),
SidecarCPURequest: request,
SidecarCPULimit: limit,
AlwaysPullSidecar: viper.GetBool(pullSidecarFlag),
KeyFile: viper.GetString(keyFileFlag),
CertFile: viper.GetString(certFileFlag),
KubeConfig: viper.GetString(kubeconfigFlag),
PrometheusMetrics: viper.GetBool(enablePrometheusMetricsFlag),
Stackdriver: viper.GetBool(enableStackdriverMetricsFlag),
GCPProjectID: viper.GetString(projectIDFlag),
NumWorkers: int(viper.GetInt32(numWorkersFlag)),
APIServerSustainedQPS: int(viper.GetInt32(apiServerSustainedQPSFlag)),
APIServerBurstQPS: int(viper.GetInt32(apiServerBurstQPSFlag)),
LogDir: viper.GetString(logDirFlag),
LogSizeLimitMB: int(viper.GetInt32(logSizeLimitMBFlag)),
DisableGameServerContainerServiceAccount: viper.GetBool(disableGameServerContainerServiceAccountFlag),
}
}

// config stores all required configuration to create a game server controller.
type config struct {
MinPort int32
MaxPort int32
SidecarImage string
SidecarCPURequest resource.Quantity
SidecarCPULimit resource.Quantity
AlwaysPullSidecar bool
PrometheusMetrics bool
Stackdriver bool
KeyFile string
CertFile string
KubeConfig string
GCPProjectID string
NumWorkers int
APIServerSustainedQPS int
APIServerBurstQPS int
LogDir string
LogSizeLimitMB int
MinPort int32
MaxPort int32
SidecarImage string
SidecarCPURequest resource.Quantity
SidecarCPULimit resource.Quantity
AlwaysPullSidecar bool
PrometheusMetrics bool
Stackdriver bool
DisableGameServerContainerServiceAccount bool
KeyFile string
CertFile string
KubeConfig string
GCPProjectID string
NumWorkers int
APIServerSustainedQPS int
APIServerBurstQPS int
LogDir string
LogSizeLimitMB int
}

// validate ensures the ctlConfig data is valid.
Expand Down
2 changes: 2 additions & 0 deletions install/helm/agones/templates/controller.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,8 @@ spec:
value: {{ .Values.agones.controller.apiServerQPS | quote }}
- name: API_SERVER_QPS_BURST
value: {{ .Values.agones.controller.apiServerQPSBurst | quote }}
- name: DISABLE_GAMESERVER_SERVICE_ACCOUNT
value: {{ .Values.gameservers.disableGameServerContainerServiceAccount | quote }}
{{- if .Values.agones.controller.persistentLogs }}
- name: LOG_DIR
value: "/home/agones/logs"
Expand Down
2 changes: 1 addition & 1 deletion pkg/gameservers/controller.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -63,9 +63,9 @@ type Controller struct {
baseLogger *logrus.Entry
sidecarImage string
alwaysPullSidecarImage bool
disableGameServerContainerServiceAccount bool
sidecarCPURequest resource.Quantity
sidecarCPULimit resource.Quantity
disableGameServerContainerServiceAccount bool
crdGetter v1beta1.CustomResourceDefinitionInterface
podGetter typedcorev1.PodsGetter
podLister corelisterv1.PodLister
Expand Down
2 changes: 1 addition & 1 deletion site/content/en/docs/Installation/helm.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@ The following tables lists the configurable parameters of the Agones chart and t
| --------------------------------------------------- | ----------------------------------------------------------------------------------------------- | ---------------------- |
| `agones.controller.persistentLogs` | Store Agones controller logs in a temporary volume attached to a container for debugging | `true` |
| `agones.controller.persistentLogsSizeLimitMB` | Maximum total size of all Agones container logs in MB | `10000` |
| `gameservers.disableGameServerContainerServiceAccount | When enabled, mounts an `emptyDir` over the service account token in the GameServer container, to stop game server processes from accessing Kubernetes | `true` |
| `gameservers.disableGameServerContainerServiceAccount` | When enabled, mounts an `emptyDir` over the service account token in the GameServer container, to stop game server processes from accessing Kubernetes | `true` |

{{% /feature %}}

Expand Down

0 comments on commit 44142cf

Please sign in to comment.