feature: add k8s for PAM #79

fangpenlin · 2025-12-03T05:27:52Z

Description 📣

ref: https://linear.app/infisical/issue/PAM-12/add-support-for-kubernetes-resource-in-pam

Type ✨

Tests 🛠️

Please read desc in this PR:

Infisical/infisical#4981 (comment)

gitguardian · 2025-12-03T05:27:57Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

packages/pam/local/kubernetes-proxy.go

greptile-apps · 2025-12-05T21:15:45Z

Greptile Overview

Greptile Summary

This PR adds Kubernetes support to the PAM (Privileged Access Management) system, enabling users to access Kubernetes clusters through the Infisical gateway with session auditing. The implementation follows existing patterns for SSH and database PAM proxies.

Key Changes

New HTTP/WebSocket proxy handler in packages/pam/handlers/kubernetes/proxy.go for forwarding Kubernetes API requests
Local proxy server in packages/pam/local/kubernetes-proxy.go that automatically updates user's kubeconfig
Extended session logging to support HTTP events alongside existing terminal events
Added infisical pam kubernetes access-account CLI command with duration and port flags

Security & Quality Issues Found

DoS vulnerability: Unbounded request body reads at proxy.go:111 could exhaust memory - needs size limits
Memory exhaustion: Response bodies buffered entirely in memory for audit logging (proxy.go:210) - kubectl logs or kubectl cp could cause OOM
Audit gap: WebSocket traffic (kubectl exec sessions) bypasses audit logging entirely (proxy.go:273)
Sensitive data leak: Request/response headers logged without filtering (proxy.go:127)
Race condition: Kubeconfig file modified without locking (kubernetes-proxy.go:110) - concurrent writes could corrupt file
UX issue: Automatic kubeconfig modification without user opt-out option (kubernetes-proxy.go:109)
Documentation: CLI example shows incorrect path prod/ssh/my-k8s-account instead of kubernetes path (pam.go:167)

Positive Aspects

Clean integration with existing PAM architecture
Proper TLS certificate handling and validation
Session expiry and credential caching implemented correctly
Encrypted session recording with proper lifecycle management

Confidence Score: 2/5

This PR has multiple critical security issues including DoS vulnerabilities and audit logging gaps that need resolution before merging
The implementation has good architecture but contains several critical issues: (1) unbounded memory reads create DoS vectors that could crash the gateway, (2) WebSocket exec sessions have no audit logging defeating the PAM system's purpose, (3) race conditions in kubeconfig file writes could corrupt user configs. While the code structure is solid, these security and reliability issues make it unsafe to merge without fixes.
Primary attention needed on packages/pam/handlers/kubernetes/proxy.go for DoS vulnerabilities and audit logging gaps, and packages/pam/local/kubernetes-proxy.go for file locking issues

Important Files Changed

File Analysis

Filename	Score	Overview
packages/pam/handlers/kubernetes/proxy.go	3/5	New Kubernetes proxy handler with HTTP/WebSocket forwarding - has unaddressed DoS risk and missing WebSocket frame parsing for audit logs
packages/pam/local/kubernetes-proxy.go	4/5	Local Kubernetes proxy server with automatic kubeconfig updates - modifies user's kubeconfig without opt-out option
packages/pam/pam-proxy.go	5/5	Adds Kubernetes case to PAM proxy handler - clean integration with existing patterns

greptile-apps

_{10 files reviewed, 7 comments}

_{Edit Code Review Agent Settings | Greptile}

packages/pam/handlers/kubernetes/proxy.go

greptile-apps · 2025-12-05T21:15:43Z

packages/pam/local/kubernetes-proxy.go

+	// TODO: we should let the user decide whether if they want to update kubeconfig or not
+	// TODO: ideally, lock the files to avoid others from writing to it
+	// TODO: use clientcmd.ModifyConfig instead?
+	configLoader := clientcmd.NewDefaultClientConfigLoadingRules()
+	config, err := configLoader.Load()
+	if err != nil {
+		log.Fatal().Err(err).Msg("Failed to load kubernetes config")
+		return
+	}
+	clusterName := fmt.Sprintf("infisical-k8s-pam%s%s", actualAccountPath, accountName)
+
+	config.Clusters[clusterName] = &k8sapi.Cluster{
+		Server: fmt.Sprintf("http://localhost:%d", proxy.port),
+	}
+	config.AuthInfos[clusterName] = &k8sapi.AuthInfo{}
+	config.Contexts[clusterName] = &k8sapi.Context{
+		Cluster:  clusterName,
+		AuthInfo: clusterName,
+	}
+	proxy.kubeConfigOriginalContext = config.CurrentContext
+	config.CurrentContext = clusterName
+	kubeconfig := configLoader.GetDefaultFilename()
+	if err = clientcmd.WriteToFile(*config, kubeconfig); err != nil {
+		log.Fatal().Err(err).Str("kubeconfig", kubeconfig).Msg("Failed to write kubernetes config")
+		return
+	}
+	log.Info().Str("kubeconfig", kubeconfig).Msg("Updated kubeconfig file")
+	proxy.kubeConfigClusterName = clusterName
+	proxy.kubeConfigPath = kubeconfig


style: Automatic kubeconfig modification without user consent

The code automatically modifies the user's kubeconfig file and switches their context. The TODO on line 109 acknowledges users should be able to opt out, but this isn't implemented. Consider adding a --no-update-kubeconfig flag.

greptile-apps · 2025-12-05T21:15:44Z

packages/pam/local/kubernetes-proxy.go

+	// TODO: ideally, lock the files to avoid others from writing to it
+	// TODO: use clientcmd.ModifyConfig instead?


logic: Race condition: kubeconfig not locked during modification

Multiple processes could corrupt the kubeconfig if they write simultaneously. Consider using file locking (e.g., syscall.Flock) before modifying the kubeconfig.

greptile-apps · 2025-12-05T21:15:44Z

packages/cmd/pam.go

+	Use:                   "access-account <account-path>",
+	Short:                 "Access Kubernetes PAM account",
+	Long:                  "Access Kubernetes via a PAM-managed Kubernetes account. This command automatically launches a proxy connected to your Kubernetes cluster through the Infisical Gateway.",
+	Example:               "infisical pam kubernetes access-account prod/ssh/my-k8s-account --duration 2h",


syntax: Example shows incorrect path

The example uses prod/ssh/my-k8s-account but should use prod/kubernetes/... or similar to match the resource type.

fangpenlin force-pushed the PAM-12-add-k8s-support branch from a92fbc7 to 77c7b6d Compare December 4, 2025 20:52

varonix0 requested changes Dec 5, 2025

View reviewed changes

packages/pam/local/kubernetes-proxy.go Show resolved Hide resolved

fangpenlin added 27 commits December 5, 2025 11:57

Add k8s res type

18b7b41

Add k8s proxy

c7131ed

Start k8s server

b011f20

Use service account token instead

35cc671

Add k8s stuff

4b4632e

Forward k8s

aadb528

Add service account token

13e26cf

Add service account token

0e8f8b2

Add missing url param

1fa2e1e

Validate

642d40a

Fix wrong auth header set

9e4b3dc

Log k8s req/resp

ba62d71

Fix logs

f1cc245

Unify http events

af252cf

Fix http logs uploading

f9e9d07

Update kubeconfig

f78adab

Better k8s cluster name

348eaaa

Log body

270f848

Fix upload body

e06a1e8

Fix wrong url pass and streaming timeout issue

e934f5a

Forward data for websocket

3eed6fb

Improve timeout hanlding

f2d12c9

Log

8eac116

Fix writing header

9b978af

Fix header

4159446

Refactor

147602b

Improve

2fe5893

fangpenlin added 10 commits December 5, 2025 11:57

Fix data corruption issue

04ef215

Remove debug code

fc69196

Handle eof error

30d50f5

Better logs

f1aeed8

logs

5dfa985

Add todo

3d31b0b

Take new cmd args instead

dd5e17f

Actual account path

937180f

Fix print

2f0c2b3

Add msg

56e8f74

fangpenlin force-pushed the PAM-12-add-k8s-support branch from f745441 to 56e8f74 Compare December 5, 2025 20:05

fangpenlin added 8 commits December 5, 2025 12:07

Add missing arg

0966039

Fix missing args

d3fdf93

Fix prompt msg

f6a07ed

Remove unused dep

c7e3c49

Revert context

8873f96

Upgrade deps

929778f

Upgrade deps

ed57430

Try to revert deps

b1ae768

fangpenlin mentioned this pull request Dec 5, 2025

feature: add k8s for PAM Infisical/infisical#4981

Open

6 tasks

fangpenlin marked this pull request as ready for review December 5, 2025 21:12

greptile-apps bot reviewed Dec 5, 2025

View reviewed changes

fangpenlin added 2 commits December 5, 2025 13:40

Cluster name

f235681

Remove debug log

36bb8fa

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feature: add k8s for PAM #79

feature: add k8s for PAM #79

Uh oh!

fangpenlin commented Dec 3, 2025 •

edited

Loading

Uh oh!

gitguardian bot commented Dec 3, 2025 •

edited

Loading

Uh oh!

Uh oh!

greptile-apps bot commented Dec 5, 2025

Uh oh!

greptile-apps bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot Dec 5, 2025

Uh oh!

greptile-apps bot Dec 5, 2025

Uh oh!

greptile-apps bot Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// TODO: ideally, lock the files to avoid others from writing to it
		// TODO: use clientcmd.ModifyConfig instead?

feature: add k8s for PAM #79

Are you sure you want to change the base?

feature: add k8s for PAM #79

Uh oh!

Conversation

fangpenlin commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description 📣

Type ✨

Tests 🛠️

Uh oh!

gitguardian bot commented Dec 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

️✅ There are no secrets present in this pull request anymore.

Uh oh!

Uh oh!

greptile-apps bot commented Dec 5, 2025

Greptile Overview

Greptile Summary

Key Changes

Security & Quality Issues Found

Positive Aspects

Confidence Score: 2/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Dec 5, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

fangpenlin commented Dec 3, 2025 •

edited

Loading

gitguardian bot commented Dec 3, 2025 •

edited

Loading