---
description: >-
  This page shows a privilege escalation scenario given that tekton is installed
  in the cluster and that you can create a namespace (sometimes edit rights are
  enough)
---

# OpenShift - Tekton

**The original author of this page is** [**Haroun**](https://www.linkedin.com/in/haroun-al-mounayar-571830211)

### What is tekton

According to the doc: _Tekton is a powerful and flexible open-source framework for creating CI/CD systems, allowing developers to build, test, and deploy across cloud providers and on-premise systems._ Both Jenkins and Tekton can be used to test, build and deploy applications, however Tekton is Cloud Native. 

With Tekton everything is represented by YAML files. Developers can create Custom Resources (CR) of type `Pipelines` and specify multiple `Tasks` in them that they want to run. To run a Pipeline resources of type `PipelineRun` must be created.

When tekton is installed a service account (sa) called pipeline is created in every namespace. When a Pipeline is ran, a pod will be spawned using this sa called `pipeline` to run the tasks defined in the YAML file.

{% embed url="https://tekton.dev/docs/getting-started/pipelines/" %}
Tekton Doc about Pipelines
{% endembed %}

### The Pipeline service account capabilities

By default, the pipeline service account can use the `pipelines-scc` capability. This is due to the global default configuration of tekton. Actually, the global config of tekton is also a YAML in an openshift object called `TektonConfig` that can be seen if you have some reader roles in the cluster.

```yaml
apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  ...
  ...
  platforms:
    openshift:
      scc:
        default: "pipelines-scc"
```

In any namespace, if you can get the pipeline service account token you will be able to use `pipelines-scc`.

### The Misconfig

The problem is that the default scc that the pipeline sa can use is user controllable. This can be done using a label in the namespace definition. For instance, if I can create a namespace with the following yaml definition:

```yaml
apiVersion: v1
kind: Namespace
metadata:
  name: test-namespace
  annotations:
    operator.tekton.dev/scc: privileged
```

The tekton operator will give to the pipeline service account in `test-namespace` the ability to use the scc privileged. This will allow the mounting of the node.

### The fix

Tekton documents about how to restrict the override of scc by adding a label in the `TektonConfig` object.

{% embed url="https://tekton.dev/docs/operator/sccconfig/" %}
Tekton doc about scc
{% endembed %}

This label is called `max-allowed` 

```yaml
apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  ...
  ...
  platforms:
    openshift:
      scc:
        default: "restricted-v2"
        maxAllowed: "privileged"
```