Skip to content

chore(deployment tooling): Update Prowler API with rotating K8S access keys #6986

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

metahertz
Copy link
Contributor

Context

newer versions of the kubernetes API do not allow long-lived/non-expiring tokens to be bound to a service account, while there are workarounds, certain clusters (Auto EKS from my current experience and others on the Community Slack) do now allow non-expiring tokens and force the TTL/Expiry down to a global value.

Solution here is the Kubernetes-documented way to access rotating service credentials, via a 'projected' volume type into a POD inside the k8s cluster; which will provide a mount with a rotating token for that service account.
Example Pod Snippet:

      volumes:
      - name: sa-token
        projected:
          sources:
          - serviceAccountToken:
              path: token
              expirationSeconds: 3600

This PR adds a simple deployment, running a pod, mounting the existing prowler prowler-ns/prowler-sa service account and a filesystem listener to auto update our Prowler API with any auth changes.

Description

See documentation in PR.

Checklist

API

  • [NO] Verify if API specs need to be regenerated.
  • [NO] Check if version updates are required (e.g., specs, Poetry, etc.).
  • [NO] Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

@jfagoagas jfagoagas changed the title Deployment Tooling: Update Prowler API with rotating K8S access keys chore(deployment tooling): Update Prowler API with rotating K8S access keys Feb 19, 2025
@MrCloudSec MrCloudSec self-requested a review February 27, 2025 10:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant