You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: keps/sig-cli/2381-future-of-kubectl-cp/README.md
+22-41Lines changed: 22 additions & 41 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,22 +1,3 @@
1
-
---
2
-
title: future-of-kubectl-cp
3
-
authors:
4
-
- "@sallyom"
5
-
owning-sig: sig-cli
6
-
participating-sigs:
7
-
- sig-usability
8
-
reviewers:
9
-
- "@liggitt"
10
-
- "@brendandburns"
11
-
approvers:
12
-
- "@pwittrock"
13
-
- "@soltysh"
14
-
editor: TBD
15
-
creation-date: 2019-09-20
16
-
last-updated: 2019-09-20
17
-
status: provisional
18
-
---
19
-
20
1
# future-of-kubectl-cp
21
2
22
3
## Table of Contents
@@ -60,26 +41,26 @@ status: provisional
60
41
61
42
## Summary
62
43
63
-
This document summarizes and originates from this email thread,
64
-
[Proposal to drop kubectl cp](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/kubernetes-sig-cli/_zUy67lK49k/aE6vncYiAgAJ).
44
+
This document summarizes and originates from this email thread,
45
+
[Proposal to drop kubectl cp](https://groups.google.com/forum/?utm_medium=email&utm_source=footer#!msg/kubernetes-sig-cli/_zUy67lK49k/aE6vncYiAgAJ).
65
46
66
47
This document aims to solidify the future of `kubectl cp` as a tool that provides basic function of copying files between local environments and pods. Any advanced use cases
67
-
such as those involving symlinks or modifying file permissions should be performed outside of `kubectl cp` through `kubectl exec`, addons, or shell commands.
48
+
such as those involving symlinks or modifying file permissions should be performed outside of `kubectl cp` through `kubectl exec`, addons, or shell commands.
68
49
69
50
Over the past few releases, there have been numerous security issues with `kubectl cp` that have resulted in release updates in all supported versions of kubectl.
70
51
At the same time,any new PR that extends `kubectl cp` must undergo extra reviews to evaluate security threats that may arise [1][2]. Over the past few months,
71
52
security fixes have required dropping edge cases and function of the command. It is increasingly difficult to maintain a cp command that is both
72
53
useful and secure. There are alternative approaches that provide the same function as `kubectl cp`[3]. Using `kubectl exec ...| tar`
73
54
provides transparency when copying files as well as mitigations for path traversals, symlink directory escapes, tar bombs, and other exploits.
74
55
Use of tar is more featureful, in that it can preserve file permissions and copy pod-to-pod. Also, `kubectl cp` is dependent on the tar binary
75
-
in a container. A malicious tar binary is outside of what `kubectl cp` can control.
56
+
in a container. A malicious tar binary is outside of what `kubectl cp` can control.
76
57
77
-
With all of this in mind the cost and risk of maintaining the cp command should be weighed against what is considered crucial functionality in kubectl.
78
-
It's better to address 80% of use cases with a simple tool than trying to address the remaining 20% at the cost of risking those 80%.
58
+
With all of this in mind the cost and risk of maintaining the cp command should be weighed against what is considered crucial functionality in kubectl.
59
+
It's better to address 80% of use cases with a simple tool than trying to address the remaining 20% at the cost of risking those 80%.
- To use `kubectl cp`, container images are required to have the tar binary. `kubectl cp` is not available when running containers from the minimal [scratch image](https://hub.docker.com/_/scratch/).
92
-
Running from scratch is by itself a tactic to securing containers, as it encourages the best practice of limiting the tools packaged in an image to only what's required by a workload.
72
+
- To use `kubectl cp`, container images are required to have the tar binary. `kubectl cp` is not available when running containers from the minimal [scratch image](https://hub.docker.com/_/scratch/).
73
+
Running from scratch is by itself a tactic to securing containers, as it encourages the best practice of limiting the tools packaged in an image to only what's required by a workload.
93
74
94
-
This proposal is that `kubectl cp` should perform only basic copying of files. Advanced features of file copying should be out of scope for `kubectl cp`.
75
+
This proposal is that `kubectl cp` should perform only basic copying of files. Advanced features of file copying should be out of scope for `kubectl cp`.
95
76
96
77
### Goals for kubectl cp
97
78
@@ -103,18 +84,18 @@ This proposal is that `kubectl cp` should perform only basic copying of files.
103
84
### Non-Goals
104
85
105
86
For either of these, a separate proposal weighing the cost/benefit would be required. These are out of scope of this proposal to simplify `kubectl cp`:
106
-
- Rewrite `kubectl cp` to not use tar, by modifying CRI as outlined partially [here](https://github.com/kubernetes/kubernetes/issues/58512).
87
+
- Rewrite `kubectl cp` to not use tar, by modifying CRI as outlined partially [here](https://github.com/kubernetes/kubernetes/issues/58512).
107
88
- Rewrite `kubectl cp` to be functional in scratch based containers through use of ephemeral containers as outlined [here](https://github.com/kubernetes/kubernetes/issues/58512#issuecomment-528384746)
108
89
109
90
## Proposal
110
91
111
92
-`kubectl cp` should provide simple function of copying single file or directory between local environments and pods.
112
-
- Identify and document `kubectl exec` commands to address more advanced options for copying files.
93
+
- Identify and document `kubectl exec` commands to address more advanced options for copying files.
113
94
- Provide users attempting to use `kubectl cp + symlinks/etc` with output showing comparable `kubectl exec ...| tar` cmds.
114
-
- It is up for a decision in this proposal whether the community prefers to implement the `shelling out to tar from within kubectl cp`
115
-
or leave as suggestions in error output.
116
-
- Barring decision of the above, only the user stories listed below should be supported by `kubectl cp`. If additional user stories are added via shelling out to tar from kubectl,
117
-
those will be outlined below.
95
+
- It is up for a decision in this proposal whether the community prefers to implement the `shelling out to tar from within kubectl cp`
96
+
or leave as suggestions in error output.
97
+
- Barring decision of the above, only the user stories listed below should be supported by `kubectl cp`. If additional user stories are added via shelling out to tar from kubectl,
98
+
those will be outlined below.
118
99
119
100
### User Stories
120
101
@@ -138,7 +119,7 @@ or leave as suggestions in error output.
138
119
### Risks and Mitigations
139
120
140
121
Any scripts or automation that currently rely on advanced features of `kubectl cp` will be broken.
141
-
To mitigate, detailed information about why the command now fails as well as example `kubectl exec ...| tar` alternatives will be output.
122
+
To mitigate, detailed information about why the command now fails as well as example `kubectl exec ...| tar` alternatives will be output.
142
123
143
124
## Design Details
144
125
@@ -152,8 +133,8 @@ Ensure that failure includes example alternative approach, plus information abou
152
133
### Upgrade / Downgrade Strategy
153
134
154
135
`kubectl cp` function removed as a result of a CVE fix or other will be documented clearly.
155
-
Information about why subcommand/option is no longer supported, what files are skipped, and also alternative `kubectl exec ...| tar` commands
156
-
will be included in failed command output. This output will then always be given (not just for a deprecation period).
136
+
Information about why subcommand/option is no longer supported, what files are skipped, and also alternative `kubectl exec ...| tar` commands
137
+
will be included in failed command output. This output will then always be given (not just for a deprecation period).
157
138
158
139
### Version Skew Strategy
159
140
@@ -162,4 +143,4 @@ will be included in failed command output. This output will then always be give
162
143
## Drawbacks
163
144
164
145
Automation scripts that include `kubectl cp` will be broken if options and features are removed from the command.
165
-
The motivation of improving security is weighed against this potential drawback.
146
+
The motivation of improving security is weighed against this potential drawback.
0 commit comments