From a24e8c3c93b2243c09e7cf8636f250a805bc07f2 Mon Sep 17 00:00:00 2001 From: Aaron Small Date: Tue, 6 Aug 2019 08:30:27 -0700 Subject: Added final reports --- .../ancillary-data/dataflow/updated-dataflow.dot | 217 +++++++++++++++++++++ 1 file changed, 217 insertions(+) create mode 100644 wg-security-audit/ancillary-data/dataflow/updated-dataflow.dot (limited to 'wg-security-audit/ancillary-data/dataflow/updated-dataflow.dot') diff --git a/wg-security-audit/ancillary-data/dataflow/updated-dataflow.dot b/wg-security-audit/ancillary-data/dataflow/updated-dataflow.dot new file mode 100644 index 00000000..671e2dde --- /dev/null +++ b/wg-security-audit/ancillary-data/dataflow/updated-dataflow.dot @@ -0,0 +1,217 @@ +digraph tm { + graph [ + fontname = Arial; + fontsize = 14; + ] + node [ + fontname = Arial; + fontsize = 14; + rankdir = lr; + ] + edge [ + shape = none; + fontname = Arial; + fontsize = 12; + ] + labelloc = "t"; + fontsize = 20; + nodesep = 1; + +subgraph cluster_bfaefefcfbeeafeefac { + graph [ + fontsize = 10; + fontcolor = firebrick2; + style = dashed; + color = firebrick2; + label = <Internet>; + ] + +bfbeacdafaceebdccfdffcdfcedfec [ + shape = square; + label = <
External Actor
>; +] +abaadcacbbafdffbcffffbeedef [ + shape = square; + label = <
Developer
>; +] +adafdaeaedeedcafe [ + shape = square; + label = <
End User
>; +] + +} + +subgraph cluster_bbfdadaacbdaedcebfec { + graph [ + fontsize = 10; + fontcolor = firebrick2; + style = dashed; + color = firebrick2; + label = <Master Control Data>; + ] + +bfffcaeeeeedccabfaaeff [ + shape = none; + color = black; + label = <
N-ary etcd servers
>; +] + +} + +subgraph cluster_afeffbbfdbeeefcabddacdba { + graph [ + fontsize = 10; + fontcolor = firebrick2; + style = dashed; + color = firebrick2; + label = <API Server>; + ] + +bdfbefabdbefeacdfcabaac [ + shape = square; + label = <
Malicious Internal User
>; +] +fabeebdadbcdffdcdec [ + shape = square; + label = <
Administrator
>; +] +eadddadcfbabebaed [ + shape = circle + color = black + label = <
kube-apiserver
>; +] + +} + +subgraph cluster_cebcbebffccbfedcaffbb { + graph [ + fontsize = 10; + fontcolor = firebrick2; + style = dashed; + color = firebrick2; + label = <Master Control Components>; + ] + +ffceacecdbcacdddddffbfa [ + shape = circle + color = black + label = <
kube-scheduler
>; +] +adffdceecfcfbcfdaefca [ + shape = circle + color = black + label = <
CCM/KCM
>; +] + +} + +subgraph cluster_baaffdafbdceebaaafaefeea { + graph [ + fontsize = 10; + fontcolor = firebrick2; + style = dashed; + color = firebrick2; + label = <Worker>; + ] + +dbddcfaeaacebaecba [ + shape = circle + color = black + label = <
kubelet
>; +] +ddcaffdfdebdaeff [ + shape = circle + color = black + label = <
kube-proxy
>; +] +bcdcebabbdaadffeaeddcce [ + shape = circle; + color = black; + + label = <
iptables
>; +] + +} + +subgraph cluster_fdcecbcfbeadaccab { + graph [ + fontsize = 10; + fontcolor = firebrick2; + style = dashed; + color = firebrick2; + label = <Container>; + ] + +bdfadfbeeaedceab [ + shape = square; + label = <
Internal Attacker
>; +] +eefbffbeaaeecaceaaabe [ + shape = circle + color = black + label = <
Pods
>; +] + +} + + eadddadcfbabebaed -> bfffcaeeeeedccabfaaeff [ + color = black; + label = <
All kube-apiserver data
>; + ] + eadddadcfbabebaed -> dbddcfaeaacebaecba [ + color = black; + label = <
kubelet Health, Status, &c.
>; + ] + eadddadcfbabebaed -> ddcaffdfdebdaeff [ + color = black; + label = <
kube-proxy Health, Status, &c.
>; + ] + eadddadcfbabebaed -> ffceacecdbcacdddddffbfa [ + color = black; + label = <
kube-scheduler Health, Status, &c.
>; + ] + eadddadcfbabebaed -> adffdceecfcfbcfdaefca [ + color = black; + label = <
{kube, cloud}-controller-manager Health, Status, &c.
>; + ] + dbddcfaeaacebaecba -> eadddadcfbabebaed [ + color = black; + label = <
HTTP watch for resources on kube-apiserver
>; + ] + ddcaffdfdebdaeff -> eadddadcfbabebaed [ + color = black; + label = <
HTTP watch for resources on kube-apiserver
>; + ] + adffdceecfcfbcfdaefca -> eadddadcfbabebaed [ + color = black; + label = <
HTTP watch for resources on kube-apiserver
>; + ] + ffceacecdbcacdddddffbfa -> eadddadcfbabebaed [ + color = black; + label = <
HTTP watch for resources on kube-apiserver
>; + ] + dbddcfaeaacebaecba -> bcdcebabbdaadffeaeddcce [ + color = black; + label = <
kubenet update of iptables (... ipvs, &c) to setup Host-level ports
>; + ] + ddcaffdfdebdaeff -> bcdcebabbdaadffeaeddcce [ + color = black; + label = <
kube-prxy update of iptables (... ipvs, &c) to setup all pod networking
>; + ] + dbddcfaeaacebaecba -> eefbffbeaaeecaceaaabe [ + color = black; + label = <
kubelet to pod/CRI runtime, to spin up pods within a host
>; + ] + adafdaeaedeedcafe -> eefbffbeaaeecaceaaabe [ + color = black; + label = <
End-user access of Kubernetes-hosted applications
>; + ] + bfbeacdafaceebdccfdffcdfcedfec -> eefbffbeaaeecaceaaabe [ + color = black; + label = <
External Attacker attempting to compromise a trust boundary
>; + ] + bdfadfbeeaedceab -> eefbffbeaaeecaceaaabe [ + color = black; + label = <
Internal Attacker with access to a compromised or malicious pod
>; + ] +} -- cgit v1.2.3