So, as you may know, nginx-ingress just had 4 vulnerabilities patched, one of them a 9.8 CVE. I'm now looking at upgrading rke2-nginx-ingress in my rke2 cluster. The version is set in the /var/lib/rancher/rke2/server/manifests/rke2-ingress-nginx.yaml file I thought it would be a bit simple to just change the "helm.cattle.io/chart-url:" annotation to a newer one. But when I restart rke2-server, the url is overwritten with the old one. I assume either rke2 is doing that (in which case my only choice is upgrading rke2), or, since this is an HA cluster, that the node is "syncing" with the other 2 nodes.

Looks like vulnerable and upgrade available soon https://github.com/rancher/rke2/issues/7953#issuecomment-2749871965

Alright alright, thank you! I guess, though, that Harvester will be another big job 😓

Yeah... Off to disable webhook admissions in both!

https://gist.github.com/nirohfeld/7a7c82c62321de9c2ef95d266b241fcb Found this to test if it's exposed

As it's type clusterIP, not sure if it is available from outside the cluster. Hopefully SUSE will publish an advisory soon to clarify

Yep so either you would have to manually expose it. Or you run a compromised pod without segmenting it properly

ClusterIP is not reachable from "outside", but from inside the cluster. Any pod in the same namespace can talk to it. Also, if a networkpolicy is in place, pods in other namespaces authorized to do so can talk to the admission controler. Does anyone know, if we can just remove the service? Then it would not be accessible from other PODs.

Uhm, I think you should disable the admission controller outright. In case you delete the svc but some part tries talking to it and fails because of that

@powerful-easter-15334 Just found out, that the svc should not be deleted... So no easy fix. I see the patch is already released here https://github.com/rancher/ingress-nginx/releases/tag/v1.12.1-hardened1 and hopefully it will make to into the next rke2 patch releases

Cool, thank you!

if you are running rke2 with ingress-nginx addon, to mitigate, you will create/edit the helmchartconfig crd and disable the admission controller.

---
apiVersion: <http://helm.cattle.io/v1|helm.cattle.io/v1>
kind: HelmChartConfig
metadata:
  name: rke2-ingress-nginx
  namespace: kube-system
spec:
  valuesContent: |-
    controller:
      admissionWebhooks:
        enabled: false

Right, yeah, makes sense

Don't think so, it is bundled with the version of rke2 you are on.

Yeah no, you're probably right. Unless you change the image which is used... Eh, no need to complicate my life that much