Rollback privilege escalation

Signed-off-by: Max Cao <[email protected]>
kedacore · Nov 5, 2024 · c5bd54f · c5bd54f
1 parent 6c9e605
commit c5bd54f
Show file tree

Hide file tree

Showing 3 changed files with 2 additions and 10 deletions.
diff --git a/config/rbac/role.yaml b/config/rbac/role.yaml
@@ -45,13 +45,6 @@ rules:
   verbs:
   - list
   - watch
-- apiGroups:
-  - ""
-  resources:
-  - serviceaccounts/token
-  verbs:
-  - create
-  - get
 - apiGroups:
   - '*'
   resources:

diff --git a/controllers/keda/scaledobject_controller.go b/controllers/keda/scaledobject_controller.go
@@ -58,7 +58,6 @@ import (
 // +kubebuilder:rbac:groups=autoscaling,resources=horizontalpodautoscalers,verbs=get;list;watch;update;patch;create;delete
 // +kubebuilder:rbac:groups="",resources=configmaps;configmaps/status,verbs=get;list;watch
 // +kubebuilder:rbac:groups="",resources=events,verbs=create;patch
-// +kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create;get
 // +kubebuilder:rbac:groups="",resources=pods;services;services;secrets;external,verbs=get;list;watch
 // +kubebuilder:rbac:groups="*",resources="*/scale",verbs=get;list;watch;update;patch
 // +kubebuilder:rbac:groups="",resources="serviceaccounts",verbs=list;watch

diff --git a/pkg/scaling/resolver/scale_resolvers.go b/pkg/scaling/resolver/scale_resolvers.go
@@ -614,7 +614,7 @@ func resolveBoundServiceAccountToken(ctx context.Context, client client.Client,
 		return ""
 	}
 	var err error
-	expirySeconds := ptr.Int64(3600)
+	expirySeconds := ptr.Int64(3600) // default expiry is 1 hour
 	if expiry != "" {
 		duration, err := time.ParseDuration(expiry)
 		if err != nil {
@@ -651,7 +651,7 @@ func generateToken(ctx context.Context, serviceAccountName, namespace string, ex
 		log.Error(err, "error trying to create token for service account", "ServiceAccount.Name", serviceAccountName)
 		return ""
 	}
-	log.Info("Service account token created successfully", "ServiceAccount.Name", serviceAccountName, "Token", token.Status.Token)
+	log.Info("Service account token created successfully", "ServiceAccount.Name", serviceAccountName)
 	return token.Status.Token
 }