Skip to content

Latest commit

 

History

History
61 lines (50 loc) · 4.71 KB

threat-modeling.md

File metadata and controls

61 lines (50 loc) · 4.71 KB

Threat Model Analysis for airflow-helm/charts

Threat: Default Secrets Exploitation

  • Description: Attackers can exploit publicly known default secrets (e.g., database passwords, Redis passwords) if they are not overridden during chart installation. Attackers could gain unauthorized access to Airflow components and underlying infrastructure.
  • Impact: Full compromise of Airflow installation, data breaches, data manipulation, service disruption, potential lateral movement to other systems.
  • Affected Component: All components relying on secrets (Database, Redis, Airflow internal components).
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Always override default secrets with strong, randomly generated values during Helm chart installation.
    • Utilize Kubernetes Secrets or external secret management solutions (Vault, cloud provider secret managers).
    • Implement regular secret rotation policies.

Threat: Insecure Default Configurations

  • Description: The chart might enable insecure default configurations (e.g., permissive access control, disabled security features). Attackers can leverage these misconfigurations to bypass security controls, gain unauthorized access, or perform malicious actions.
  • Impact: Unauthorized access to Airflow Webserver, API, database, or other components. Data breaches, data manipulation, service disruption, privilege escalation.
  • Affected Component: Airflow Webserver, Scheduler, Flower, Database, Redis, Kubernetes Services.
  • Risk Severity: High
  • Mitigation Strategies:
    • Thoroughly review the values.yaml and chart documentation.
    • Explicitly enable security features like RBAC, network policies, and TLS/SSL.
    • Harden configurations based on security best practices and organizational policies.
    • Regularly audit and review configurations.

Threat: Misconfiguration via Chart Values

  • Description: Incorrectly configured values in values.yaml or via --set flags can introduce vulnerabilities (e.g., disabling authentication, exposing ports). Attackers can exploit these misconfigurations to gain unauthorized access or compromise the system.
  • Impact: Unauthorized access, data breaches, service disruption, denial of service, potential for further exploitation of underlying infrastructure.
  • Affected Component: All configurable components via values.yaml.
  • Risk Severity: High
  • Mitigation Strategies:
    • Thoroughly understand all configuration options in values.yaml and chart documentation.
    • Validate configurations before deployment using automated tools and manual review.
    • Use infrastructure-as-code practices to manage and version configurations.
    • Implement configuration drift detection and alerting.

Threat: Unnecessary Port Exposure

  • Description: The chart might expose services and ports unnecessarily (e.g., database ports, Redis ports, Flower) without proper network restrictions. Attackers can exploit these exposed ports to directly access services from unintended networks or the public internet.
  • Impact: Direct access to sensitive services, data breaches, denial of service, potential for lateral movement within the network.
  • Affected Component: Kubernetes Services, Ingress configurations.
  • Risk Severity: High
  • Mitigation Strategies:
    • Review default service definitions and ingress configurations.
    • Implement strict Kubernetes Network Policies to limit access within the cluster.
    • Use cloud provider firewall rules or security groups to restrict external access.
    • Utilize Ingress Controllers with authentication and authorization mechanisms.

Threat: Vulnerable Base Docker Images

  • Description: Docker images used by the chart might be based on vulnerable base images. Attackers can exploit known vulnerabilities in these base images to compromise containers and potentially the underlying Kubernetes nodes.
  • Impact: Container compromise, potential node compromise, data breaches, service disruption, privilege escalation.
  • Affected Component: Docker images for Webserver, Scheduler, Workers, etc.
  • Risk Severity: High
  • Mitigation Strategies:
    • Regularly scan Docker images for vulnerabilities using image scanning tools.
    • Ensure the chart uses up-to-date and patched base images.
    • Consider using minimal and hardened base images.
    • Implement image vulnerability scanning in CI/CD pipelines.