手动 ArgoCD 网络策略缓解措施 (MHSA-47m3-95c7-g2g8)

针对 Automation Suite 中未经身份验证的网络访问 ArgoCD 存储库服务器和 Redis 的解决方案，借助手动网络策略缓解程序。

描述

ArgoCD 最近发布了一个影响 ArgoCD repo-server组件的漏洞，并且 ArgoCD 目前未修复该漏洞。

可以从集群网络中的任何 Pod 访问 ArgoCD repo-server （端口 8081）和 ArgoCD Redis，因为默认情况下没有网络策略限制进入这些组件。因此，集群网络中的任何 Pod 都可以直接连接到它们，因为 ArgoCD 不需要对这些内部组件进行身份验证。有关详细信息，请参阅MHSA-47m3-95c7-g2g8 。

为缓解此问题，您必须手动应用本页“解决方案”部分中所述的网络策略。

先决条件

• 从对集群具有kubectl访问权限的主机运行此过程。
• 该过程采用默认的 Automation Suite argocd命名空间。如果 ArgoCD 使用不同的命名空间，请在运行脚本之前设置ARGOCD_NS 。
• 此缓解措施依赖于 Kubernetes 网络策略强制执行。Automation Suite 支持的集群使用兼容的 CNI（容器网络接口）配置。

解决方案

1. 运行以下脚本。它会检测您的 ArgoCD 版本和 Redis 模式（独立或高可用性，HA），并自动应用匹配的网络策略：

   export ARGOCD_NS="${ARGOCD_NS:-argocd}"
   export ARGOCD_RELEASE="$(kubectl -n "$ARGOCD_NS" get pod -l app.kubernetes.io/name=argocd-server -o jsonpath='{.items[0].metadata.labels.app\.kubernetes\.io/instance}')"
   
   test -n "$ARGOCD_RELEASE" || { echo "Cannot detect Argo CD Helm release"; exit 1; }
   
   if kubectl -n "$ARGOCD_NS" get pod -l "release=${ARGOCD_RELEASE},app=redis-ha-haproxy,component=haproxy" --no-headers 2>/dev/null | grep -q .; then
     REDIS_MODE=ha
   else
     REDIS_MODE=standalone
   fi
   
   echo "Argo CD namespace: $ARGOCD_NS"
   echo "Argo CD release: $ARGOCD_RELEASE"
   echo "Redis mode: $REDIS_MODE"
   
   cat <<EOF | kubectl apply -f -
   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: argocd-repo-server-manual-mitigation
     namespace: ${ARGOCD_NS}
   spec:
     podSelector:
       matchLabels:
         app.kubernetes.io/name: argocd-repo-server
         app.kubernetes.io/instance: ${ARGOCD_RELEASE}
     policyTypes:
       - Ingress
     ingress:
       - from:
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-server
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-application-controller
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-applicationset-controller
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-notifications-controller
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
         ports:
           - protocol: TCP
             port: 8081
       - from:
           - namespaceSelector: {}
         ports:
           - protocol: TCP
             port: 8084
   EOF
   
   if [ "$REDIS_MODE" = "ha" ]; then
     cat <<EOF | kubectl apply -f -
   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: argocd-redis-ha-server-manual-mitigation
     namespace: ${ARGOCD_NS}
   spec:
     podSelector:
       matchLabels:
         release: ${ARGOCD_RELEASE}
         app: redis-ha
     policyTypes:
       - Ingress
     ingress:
       - from:
           - podSelector:
               matchLabels:
                 release: ${ARGOCD_RELEASE}
                 app: redis-ha
           - podSelector:
               matchLabels:
                 release: ${ARGOCD_RELEASE}
                 app: redis-ha-haproxy
                 component: haproxy
         ports:
           - protocol: TCP
             port: 6379
           - protocol: TCP
             port: 26379
   ---
   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: argocd-redis-ha-haproxy-manual-mitigation
     namespace: ${ARGOCD_NS}
   spec:
     podSelector:
       matchLabels:
         release: ${ARGOCD_RELEASE}
         app: redis-ha-haproxy
         component: haproxy
         app.kubernetes.io/name: argocd-redis-ha-haproxy
     policyTypes:
       - Ingress
     ingress:
       - from:
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-server
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-repo-server
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-application-controller
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
         ports:
           - protocol: TCP
             port: 6379
   EOF
   else
     cat <<EOF | kubectl apply -f -
   apiVersion: networking.k8s.io/v1
   kind: NetworkPolicy
   metadata:
     name: argocd-redis-manual-mitigation
     namespace: ${ARGOCD_NS}
   spec:
     podSelector:
       matchLabels:
         app.kubernetes.io/name: argocd-redis
         app.kubernetes.io/instance: ${ARGOCD_RELEASE}
     policyTypes:
       - Ingress
     ingress:
       - from:
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-server
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-repo-server
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
           - podSelector:
               matchLabels:
                 app.kubernetes.io/name: argocd-application-controller
                 app.kubernetes.io/instance: ${ARGOCD_RELEASE}
         ports:
           - protocol: TCP
             port: 6379
       - from:
           - namespaceSelector: {}
         ports:
           - protocol: TCP
             port: 9121
   EOF
   fi
   

验证

运行以下命令以确认已成功应用缓解措施：

kubectl -n "$ARGOCD_NS" get networkpolicy
kubectl -n "$ARGOCD_NS" get pods
kubectl get applications.argoproj.io -A

确认以下内容：

• argocd-repo-server-manual-mitigation存在。
• 对于 Redis HA，存在argocd-redis-ha-server-manual-mitigation和argocd-redis-ha-haproxy-manual-mitigation 。
• 对于独立 Redis，存在argocd-redis-manual-mitigation 。
• ArgoCD Pod 为Running或Completed 。
• ArgoCD 应用程序仍然是Synced和Healthy 。

确认缓解措施

在应用策略后运行这些检查。它们会验证所需的 ArgoCD 流量是否仍有效，并且不允许的流量是否已被阻止。

1. 运行以下脚本：

   export ARGOCD_NS="${ARGOCD_NS:-argocd}"
   export ARGOCD_RELEASE="${ARGOCD_RELEASE:-$(kubectl -n "$ARGOCD_NS" get pod -l app.kubernetes.io/name=argocd-server -o jsonpath='{.items[0].metadata.labels.app\.kubernetes\.io/instance}')}"
   
   if kubectl -n "$ARGOCD_NS" get pod -l "release=${ARGOCD_RELEASE},app=redis-ha-haproxy,component=haproxy" --no-headers 2>/dev/null | grep -q .; then
     REDIS_MODE=ha
   else
     REDIS_MODE=standalone
   fi
   
   SERVER_POD="$(kubectl -n "$ARGOCD_NS" get pod -l app.kubernetes.io/name=argocd-server -o jsonpath='{.items[0].metadata.name}')"
   APPSET_POD="$(kubectl -n "$ARGOCD_NS" get pod -l app.kubernetes.io/name=argocd-applicationset-controller -o jsonpath='{.items[0].metadata.name}' 2>/dev/null || true)"
   FAILED_CHECKS=""
   
   tcp_check() {
     pod="$1"
     host="$2"
     port="$3"
     expected="$4"
     name="$5"
   
     code="$(kubectl -n "$ARGOCD_NS" exec "$pod" -- sh -c '
       host="$1"
       port="$2"
       if command -v nc >/dev/null 2>&1; then
         timeout 5 nc -z -w 3 "$host" "$port" >/dev/null 2>&1
         printf "%s\n" "$?"
       elif command -v bash >/dev/null 2>&1; then
         timeout 5 bash -c "</dev/tcp/${host}/${port}" >/dev/null 2>&1
         printf "%s\n" "$?"
       else
         printf "%s\n" "NO_TCP_TOOL"
       fi
     ' sh "$host" "$port" 2>/dev/null | tail -n 1)"
   
     if [ "$expected" = "allow" ] && [ "$code" = "0" ]; then
       return
     elif [ "$expected" = "deny" ] && [ "$code" != "0" ] && [ "$code" != "NO_TCP_TOOL" ] && [ -n "$code" ]; then
       return
     else
       FAILED_CHECKS="${FAILED_CHECKS}
   - ${name}: expected ${expected}, got exit code ${code}"
     fi
   }
   
   tcp_check "$SERVER_POD" argocd-repo-server 8081 allow "argocd-server to repo-server:8081"
   
   if [ "$REDIS_MODE" = "ha" ]; then
     HAPROXY_POD="$(kubectl -n "$ARGOCD_NS" get pod -l app=redis-ha-haproxy,component=haproxy -o jsonpath='{.items[0].metadata.name}')"
   
     tcp_check "$SERVER_POD" argocd-redis-ha-haproxy 6379 allow "argocd-server to redis-ha-haproxy:6379"
     tcp_check "$HAPROXY_POD" argocd-redis-ha 6379 allow "redis-ha-haproxy to redis-ha:6379"
     tcp_check "$HAPROXY_POD" argocd-repo-server 8081 deny "redis-ha-haproxy to repo-server:8081"
   
     if [ -n "$APPSET_POD" ]; then
       tcp_check "$APPSET_POD" argocd-redis-ha-haproxy 6379 deny "applicationset-controller to redis-ha-haproxy:6379"
     fi
   else
     REDIS_POD="$(kubectl -n "$ARGOCD_NS" get pod -l app.kubernetes.io/name=argocd-redis -o jsonpath='{.items[0].metadata.name}')"
   
     tcp_check "$SERVER_POD" argocd-redis 6379 allow "argocd-server to redis:6379"
     tcp_check "$REDIS_POD" argocd-repo-server 8081 deny "redis to repo-server:8081"
   
     if [ -n "$APPSET_POD" ]; then
       tcp_check "$APPSET_POD" argocd-redis 6379 deny "applicationset-controller to redis:6379"
     fi
   fi
   
   if [ -z "$FAILED_CHECKS" ]; then
     echo "MITIGATION CHECK: PASS"
   else
     echo "MITIGATION CHECK: FAIL"
     echo "$FAILED_CHECKS"
     exit 1
   fi
   

   预期结果： MITIGATION CHECK: PASS

回滚

如果需要，请采取以下步骤删除缓解措施：

1. 删除手动缓解策略：

   kubectl -n "$ARGOCD_NS" delete networkpolicy \
     argocd-repo-server-manual-mitigation \
     argocd-redis-manual-mitigation \
     argocd-redis-ha-server-manual-mitigation \
     argocd-redis-ha-haproxy-manual-mitigation \
     --ignore-not-found
   

2. 确认回滚已成功完成：

   kubectl -n "$ARGOCD_NS" get networkpolicy
   kubectl -n "$ARGOCD_NS" get pods
   kubectl get applications.argoproj.io -A
   

   确认以下内容：

   • 手动缓解策略将被删除。
   • ArgoCD Pod 仍为Running或Completed 。
   • ArgoCD 应用程序仍然是Synced和Healthy 。