Why are Minikube clusters launched with `--vm-driver=none` vulnerable to CSRF?

Question

When launching a Minikube instance with the --vm-driver=none option one is greeted with this warning:

WARNING: IT IS RECOMMENDED NOT TO RUN THE NONE DRIVER ON PERSONAL WORKSTATIONS
    The 'none' driver will run an insecure kubernetes apiserver as root that may 
    leave the host vulnerable to CSRF attacks

Why is the host vulnerable? How would such an attack work?

Answer 1

A cross site request forgery is an attack:

that tricks a user into accidentally using their credentials to invoke a state changing activity

The argument --vm-driver=none:

this driver can be used to run the Kubernetes cluster components on the host instead of in a VM.

The documentation on attacks inside the minikube is scarce. Basically when you use --vm-driver=none the kubectl config and credentials will be root owned and will be available in the home directory. You need to move them and set appropriate permissions. Also as the secret tokens that are usually used to protect from those kind of attacks would be easily accessible by the attacker. If you do not move the components and set the permissions they could become a potential vector in using the apiserver as a confused deputy when introducing the request as root.

I think that the most dangerous part is: --vm-driver=none exposes the whole process as root. Your kubeapi is running as root. If an attacker could exploit that he would get control of a process operating inside the kernel that runs as a root - and that as we know makes the attacker the owner of the system and could become a gateway not only for the CSFR attack.

Also it is worth mentioning that security is not a priority concern in minikube as it is mostly tool for learning if you would like something more security focused you could consider kubeadm which is:

is a toolkit for bootstrapping a best-practises Kubernetes cluster on existing infrastructure.

Here are some historical conversations of Kubernetes developers about implementing CSRF and performing this kind of attacks that you can find here:

Harden master API against web attacks #10351

This is what I was able to find, I would recommend you to try to ask developers on GitHub, filling the issue to get more precise information.