Package io.fabric8.openshift.api.model.monitoring.v1

Class ArbitraryFSAccessThroughSMsConfig

  • All Implemented Interfaces:
    Editable<ArbitraryFSAccessThroughSMsConfigBuilder>, KubernetesResource, Serializable
    @Generated("io.fabric8.kubernetes.schema.generator.model.ModelGenerator")
public class ArbitraryFSAccessThroughSMsConfig
extends Object
implements Editable<ArbitraryFSAccessThroughSMsConfigBuilder>, KubernetesResource
    ArbitraryFSAccessThroughSMsConfig enables users to configure, whether a service monitor selected by the Prometheus instance is allowed to use arbitrary files on the file system of the Prometheus container. This is the case when e.g. a service monitor specifies a BearerTokenFile in an endpoint. A malicious user could create a service monitor selecting arbitrary secret files in the Prometheus container. Those secrets would then be sent with a scrape request by Prometheus to a malicious target. Denying the above would prevent the attack, users can instead use the BearerTokenSecret field.
    See Also:
    Serialized Form

    • Constructor Detail

      • ArbitraryFSAccessThroughSMsConfig

        public ArbitraryFSAccessThroughSMsConfig()
        No args constructor for use in serialization

      • ArbitraryFSAccessThroughSMsConfig

        public ArbitraryFSAccessThroughSMsConfig​(Boolean deny)

    • Method Detail

      • getDeny

        public Boolean getDeny()
        deny prevents service monitors from accessing arbitrary files on the file system. When true, service monitors cannot use file-based configurations like BearerTokenFile that could potentially access sensitive files. When false (default), such access is allowed. Setting this to true enhances security by preventing potential credential theft attacks.

      • setDeny

        public void setDeny​(Boolean deny)
        deny prevents service monitors from accessing arbitrary files on the file system. When true, service monitors cannot use file-based configurations like BearerTokenFile that could potentially access sensitive files. When false (default), such access is allowed. Setting this to true enhances security by preventing potential credential theft attacks.

      • getAdditionalProperties

        public Map<String,​Object> getAdditionalProperties()

      • setAdditionalProperty

        public void setAdditionalProperty​(String name,
                                  Object value)

      • setAdditionalProperties

        public void setAdditionalProperties​(Map<String,​Object> additionalProperties)