Uploaded image for project: 'Eclipse Che development'
  1. Eclipse Che development
  2. CHE-63

Che service account token is accessible from the terminal of a workspace

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Do
    • Icon: Major Major
    • None
    • None
    • docker
    • None
    • devex #128 February 2017
    • 10

      Every ws pod automatically mounts a volume that contains a token for service account cheserviceaccount. This volume is not needed and represent a security threat.

      kind: Pod
spec:
  volumes:
    -
      name: cheserviceaccount-token-6ch7l
      secret:
        secretName: cheserviceaccount-token-6ch7l
  containers:
    -
      volumeMounts:
        -
          name: cheserviceaccount-token-6ch7l
          readOnly: true
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    ...

      That's related to the following kubernetes issue:
      https://github.com/kubernetes/kubernetes/issues/16779

              vrubezhny Victor Rubezhny (Inactive)
              mloriedo Mario Loriedo
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: