Reported by gooleg-gh
Summary
K8s nodes in the cluster created by setup-gcp bootstrap command uses default compute service account and grants additional permissions to it. This gap is mentioned in the documentation and in the code with a TODO comment.
Recommended mitigation: Use custom node service account with minimal permissions instead.
PoC
Run the setup-gcp bootstrap command and observe the default compute service account used in the created GKECluster→MIG→InstanceTemplate.
Impact
Low risk security issue.
Compute default service account tends to accumulate permissions used in different contexts. If GKE node with that DCSA is compromised, the threat actor will gain unnecessarily broad permissions granted to the default service account.
All customers who rely on the setup-gcp bootstrap for initial GKE cluster setup are affected.
The actual permissions we need to grant to the node service account are roles/artifactRegistry.reader, so that the node can pull the Substrate container images that are built.
This is only needed for the development case, where you are building the container images and uploading them to your own private container registry.
For "normal" installs, presumably you would instead be pointing at some public container images published by the Substrate project, and this is moot.
I'd say concrete actions here are:
- Ensure that the GKE clusters we create use a dedicated node service account (this is just good hygiene)
- Once the install scripts support a "install from local checkout" vs "install from published images" distinction, we can make the permission grant conditional on "install from local checkout"
Reported by gooleg-gh
The actual permissions we need to grant to the node service account are roles/artifactRegistry.reader, so that the node can pull the Substrate container images that are built.
This is only needed for the development case, where you are building the container images and uploading them to your own private container registry.
For "normal" installs, presumably you would instead be pointing at some public container images published by the Substrate project, and this is moot.
I'd say concrete actions here are: