Security - manual NFS mount in a pod

Question

Hello

I successfully configured my AKS cluster to mount nfs share from a netapp resource.

I use PV and PVC.

If I check the mount points in the pod, I get :

nfs.xxx.com:/share/prd on /var/www/shared type nfs4 (rw,relatime,vers=4.2,rsize=1048576,wsize=1048576,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=X.X.X.X,local_lock=none,addr=Y.Y.Y.Y)

Is there way to manually mount a nfs share in the pod ? :

mount -t nfs nfs.xxx:/share/confidential /mnt

So, it could be a security issue if a pod is compromised...

Maybe, there is security configuration / isolation in AKS to deny manual nfs mounts.

I want to be sure that a pod can only access to nfs shares defined in its definition with PV and PVC.

Thanks.

David.

Answer 1

Hello @David Hautbois

As far as I know you need to be aware that the actual NFS mount happens at the Kubernetes node level. The NFS mounted on the Kubernetes node is then passed to the pod.

From here: https://learn.microsoft.com/en-us/azure/storage/files/files-nfs-protocol#security-and-networking

"The NFS protocol don't offer user-based authentication. Authentication for NFS shares is based on the configured network security rules. Due to this, to ensure only secure connections are established to your NFS share, you must set up either a private endpoint or a service endpoint for your storage account." 

To test about the access I created a Storage Class:

k apply -f - <<EOF

---

apiVersion: storage.k8s.io/v1

kind: StorageClass

metadata:

  name: azurefile-premium-nfs

allowVolumeExpansion: true

mountOptions:

  - nconnect=4

  - noresvport

  - actimeo=30

parameters:

  skuName: Premium_LRS

  protocol: nfs

provisioner: file.csi.azure.com

reclaimPolicy: Delete

volumeBindingMode: Immediate

EOF 

It seems the access to the storage account is allowed for the AKS nodes subnet. Depending on the Kubernetes CNI you are using you might have lock down differently if you want to avoid Pods being able to access the Storage Account. You mentioned "netapp resource" in your verbatim. I never used netapp with AKS so my test may not be relevant to your scenario. 

Please let me know if this helps