lbroudoux / cheese-quizz Goto Github PK

This is a suggestion to improve mtls part.

DESCRIPTION:
When applying mtls in destination rule, it is recommended to apply a policy in order to insure the traffic encryption in a strict way.

apiVersion: authentication.istio.io/v1alpha1
kind: Policy
metadata:
  name: "default"
  namespace: "microservices-demo"
spec:
  peers:
  - mtls:
      mode: STRICT

Meanwhile, when applying this policy all the system goes down. Pod go into CrashLoopBack status because liveness and readiness probes are rejected.

EXCPECTED:

• Add in the lab a tep to apply the policy
• Fix liveness and readiness probes to support the policy

HOW TO IMPROVE:
Change all the liveness and the readiness probes to use localhost check with curl (best practice), rather than httpGet which uses pod IP (and blocked by peer when a policy is applied).

exec:
  command:
  - curl
  - -f
  - http://localhost:8080/healthz # Replace port and URI by your actual health check

Source: https://istio.io/latest/faq/security/#k8s-health-checks

Greetings,

We are security researchers and we are looking for insecure coding patterns and configurations in the microservice architecture repositories. In your repository, we have found instances of default port and HTTP without TLS usage.

According to a recent report default port usages must be avoided: https://www.bleepingcomputer.com/news/security/most-cyber-attacks-focus-on-just-three-tcp-ports/#:~:text=According%20to%20the%20report%2C%20the,(Hypertext%20Transfer%20Protocol%20Secure).

Source: https://github.com/lbroudoux/cheese-quizz/blob/master/kafka-docker-compose.yml

Fix: #1

I am interested to know if you agree with the findings. Any feedback is appreciated.

Further details on default ports:

Data storage,  MySQL 3306, reff: https://dev.mysql.com/doc/mysql-port-reference/en/mysql-ports-reference-tables.html
Data storage,  Postgres 5432, reff: https://www.postgresql.org/docs/8.3/app-postgres.html 
Data storage,  MongoDB 27017, reff: https://docs.mongodb.com/manual/reference/default-mongodb-port/
Data transfer, rabbitMQ 5672, reff: https://www.rabbitmq.com/networking.html
Data transfer, Kafka 9092, reff: https://kafka.apache.org/07/documentation.html
Data transfer, HTTP, http 80 , 443 , reff: https://geekflare.com/default-port-numbers/  
Data storage,  Zookeeper 2181, reff: https://zookeeper.apache.org/doc/r3.1.2/zookeeperStarted.html
Monitoring,    zipkin 9411    , reff: https://zipkin.io/pages/extensions_choices