Reporting a Vulnerability in IONOS Cloud

#cloud-config
hostname: my-node
users:
- name: root
  lock_passwd: false
  hashed_passwd: $6$e0Uel8yf/6KFZaCK$xxx/xxx/
ntp:
  enabled: true
  ntp_client: systemd-timesyncd
  servers:
    - ntp.ubuntu.com
write_files:
# Manage networks
# Manage public network (used by K8s), set DNS resolvers and route metric
- content: |
    [Match]
    Name=ens6

    [Network]
    LinkLocalAddressing=no
    IPv6AcceptRA=no
    DHCP=ipv4

    [DHCP]
    RouteMetric=10

    [Route]
    Destination=100.64.0.0/18
    Scope=link

    [Route]
    Destination=100.96.0.0/12
    Scope=link

  owner: root:root
  path: /etc/systemd/network/10-ens6.network
  permissions: '0644'
# Manage DNS resolver for cluster.local, adds CoreDNS IP as resolver
- content: |
    [Match]
    Name=tunl0

    [Network]
    DNS=100.64.3.114
    Domains=cluster.local
  owner: root:root
  path: /etc/systemd/network/12-cluster-local-dns.network
  permissions: '0644'
# Managed authorized keys
- content: |
    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJebNzmlXyAAc7qFiUbbpNBnzRJIYMiDGClDZDNO7GUM
  owner: root:root
  path: /etc/ssh/authorized_keys_managed
  permissions: '0644'
# CSI Metadata config
- content: |
    {
      "datacenter-id": "xxx"
    }
  owner: root:root
  path: /etc/ie-csi/cfg.json
  permissions: '0644'
# Configure nginx
- content: |
    error_log stderr notice;

    worker_processes 2;
    worker_rlimit_nofile 130048;
    worker_shutdown_timeout 10s;

    events {
      multi_accept on;
      use epoll;
      worker_connections 16384;
    }

    stream {
      server {
        listen 127.0.0.1:6443;
        resolver 127.0.0.53;
        set $kube_apiserver cp-xxx.k8s.de-fra.ionos.com:101010;
        proxy_pass $kube_apiserver;
        proxy_timeout 10m;
        proxy_connect_timeout 1s;
      }
    }

    http {
      aio threads;
      aio_write on;
      tcp_nopush on;
      tcp_nodelay on;

      keepalive_timeout 75s;
      keepalive_requests 100;
      reset_timedout_connection on;
      server_tokens off;
      autoindex off;

      server {
        listen 8081;
        location /healthz {
          access_log off;
          return 200;
        }
      }
    }
  owner: root:root
  path: /etc/nginx/nginx.conf
  permissions: '0644'
# Configure nginx proxy
- content: |
    ---
    apiVersion: v1
    kind: Pod
    metadata:
      name: nginx-proxy
      namespace: kube-system
      labels:
        addonmanager.kubernetes.io/mode: Reconcile
        k8s-app: kube-nginx
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      dnsConfig:
        nameservers:
          - 212.227.123.17
          - 212.227.123.16
      nodeSelector:
        kubernetes.io/os: linux
      priorityClassName: system-node-critical
      containers:
      - name: nginx-proxy
        image: registry.infra.cluster.ionos.com/mk8s-public/images/docker.io/library/nginx:1.31.2-clean.1
        imagePullPolicy: IfNotPresent
        resources:
          requests:
            cpu: 25m
            memory: 32M
        securityContext:
          privileged: true
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
        readinessProbe:
          httpGet:
            path: /healthz
            port: http
        startupProbe:
          httpGet:
            path: /healthz
            port: http
          failureThreshold: 30
          periodSeconds: 10
        ports:
        - containerPort: 8081
          hostPort: 8081
          name: http
          protocol: TCP
        volumeMounts:
        - mountPath: /etc/nginx
          name: etc-nginx
          readOnly: true
      volumes:
      - name: etc-nginx
        hostPath:
          path: /etc/nginx
  owner: root:root
  path: /etc/kubernetes/manifests/nginx-proxy.yml
  permissions: '0644'
# Configure kubeadm
- content: |
    apiVersion: kubeadm.k8s.io/v1beta3
    kind: JoinConfiguration
    caCertPath: /etc/kubernetes/pki/ca.crt
    patches:
      directory: /etc/kubernetes/patches
    discovery:
      bootstrapToken:
        apiServerEndpoint: cp-xxx.k8s.de-fra.ionos.com:101010
        token: iy4wa1.xxx
        caCertHashes:
        - sha256:xxx
      timeout: 5m0s
    nodeRegistration:
      name: my-node
      criSocket: unix:///run/containerd/containerd.sock
      taints: null
      kubeletExtraArgs:
        runtime-cgroups: /systemd/system.slice
        kubelet-cgroups: /systemd/system.slice
        system-reserved: "memory=1024Mi"
        v: "2"
        cloud-provider: external
        resolv-conf: /etc/kubernetes/resolv.conf
        node-labels: >-
          cloud.ionos.com/node-id=NODE_ID_PLACEHOLDER,
          cloud.ionos.com/datacenter-id=xxx,
          cloud.ionos.com/nodepool-id=xxx,
          cloud.ionos.com/nodepool-name=xxx,
          pool=primary,project=xxx
  owner: root:root
  path: /etc/kubernetes/kubeadm.conf
  permissions: '0600'
# Create manage script for resolve.conf for kubelet
- content: |
    #!/bin/bash
    set -x
    SRC=/run/systemd/resolve/resolv.conf
    if ! grep -q '^nameserver ' "$SRC"; then
      echo "manage-k8s-resolvconf: no nameservers found in $SRC, not overwriting /etc/kubernetes/resolv.conf" >&2
      exit 0
    fi
    RESOLV_CONF_TMP=$(mktemp)
    cp "$SRC" $RESOLV_CONF_TMP
    sed -i '/nameserver 100.64.3.114/d' $RESOLV_CONF_TMP
    cp $RESOLV_CONF_TMP /etc/kubernetes/resolv.conf
    rm $RESOLV_CONF_TMP
    exit 0
  owner: root:root
  path: /usr/bin/manage-k8s-resolvconf.sh
  permissions: '0755'
# /run/systemd/resolve/resolv.conf systemd path unit
- content: |
    [Unit]
    Description=Watcher service for /run/systemd/resolve/resolv.conf
    Before=systemd-networkd.service
    StartLimitIntervalSec=0
    [Path]
    PathChanged=/run/systemd/resolve/
    Unit=k8s.resolvconf.manager.service
    [Install]
    WantedBy=network-online.target
  owner: root:root
  path: /etc/systemd/system/k8s.resolvconf.manager.path
  permissions: '0755'
# /run/systemd/resolve/resolv.conf systemd service unit
- content: |
    [Unit]
    Description=Calls the k8s resolvconf manager script
    [Service]
    Type=simple
    ExecStart=/usr/bin/manage-k8s-resolvconf.sh
    [Install]
    WantedBy=network-online.target
  owner: root:root
  path: /etc/systemd/system/k8s.resolvconf.manager.service
  permissions: '0755'
# configure Containerd
- content: |
    [plugins."io.containerd.grpc.v1.cri"]
      sandbox_image = "registry.infra.cluster.ionos.com/mk8s-public/images/registry.k8s.io/pause:3.10"

  owner: root:root
  path: /etc/containerd/config.toml
  append: true
  permissions: '0644'
# kubeadm kubelet-config patch (per node-pool version strip)
- content: |
    {"crashLoopBackOff":null,"imagePullCredentialsVerificationPolicy":null}
  owner: root:root
  path: /etc/kubernetes/patches/kubeletconfiguration+merge.json
  permissions: '0644'
# Node bootstrap script
- content: |
    #!/bin/bash
    # shellcheck disable=SC1083  # Disable warning caused by template markers

    # Helper functions taken from 

    # Log an error and exit.
    # Args:
    #   $1 Message to log with the error
    #   $2 The error code to return
    log::error_exit() {
      local message="${1}"
      local code="${2}"

      log::error "${message}"
      log::info "Resetting kubeadm"
      kubeadm reset -f || true
      log::error "bootstrap script $0 exiting with status ${code}"
      exit "${code}"
    }

    # Log an error but keep going.
    log::error() {
      local message="${1}"
      timestamp=$(date --iso-8601=seconds)
      echo "!!! [${timestamp}] ${1}" >&2
      shift
      for message; do
        echo "    ${message}" >&2
      done
    }

    # Print a status line.  Formatted to show up in a stream of output.
    log::info() {
      timestamp=$(date --iso-8601=seconds)
      echo "+++ [${timestamp}] ${1}"
      shift
      for message; do
        echo "    ${message}"
      done
    }

    check_kubeadm_command() {
      local command="${1}"
      local code="${2}"
      case ${code} in
      "0")
        log::info "kubeadm reported successful execution for ${command}"
        ;;
      "1")
        log::error "kubeadm reported failed action(s) for ${command}"
        ;;
      "2")
        log::error "kubeadm reported preflight check error during ${command}"
        ;;
      "3")
        log::error_exit "kubeadm reported validation error for ${command}" "${code}"
        ;;
      *)
        log::error "kubeadm reported unknown error ${code} for ${command}"
        ;;
      esac
    }

    function retry-command() {
      n=0
      local kubeadm_return
      until [ $n -ge 10 ]; do
        log::info "running '$*'"
        # shellcheck disable=SC1083
        "$@" --config=/etc/kubernetes/kubeadm.conf --v=2
        kubeadm_return=$?
        check_kubeadm_command "'$*'" "${kubeadm_return}"
        if [ ${kubeadm_return} -eq 0 ]; then
          break
        fi
        # We allow preflight errors to pass
        if [ ${kubeadm_return} -eq 2 ]; then
          break
        fi
        n=$((n + 1))
        sleep_jitter 10
      done
      if [ ${kubeadm_return} -ne 0 ]; then
        log::error_exit "too many errors, exiting" "${kubeadm_return}"
      fi
    }

    sleep_jitter() {
        local value="${1}"
        sleep $((value + RANDOM % 10))
    }

    log::info "Restart network services"
    systemctl restart systemd-resolved

    log::info "Install and enable resolv.conf services"
    systemctl daemon-reload
    systemctl enable --now k8s.resolvconf.manager.path
    systemctl enable --now k8s.resolvconf.manager.service
    log::info "Starting kubernetes node join"
    systemctl stop kubelet

    #

    while ! curl -sk --max-time 10 https://cp-xxx.k8s.de-fra.ionos.com:101010/healthz >/dev/null; do
        log::info "Waiting for cluster"
        sleep_jitter 1;
    done

    sed -i "s/NODE_ID_PLACEHOLDER/$(cat /sys/class/dmi/id/product_uuid)/g" /etc/kubernetes/kubeadm.conf
    rm -f /etc/kubernetes/kubelet.conf

    retry-command kubeadm join phase kubelet-start
    chmod 0600 /var/lib/kubelet/config.yaml

    n=0
    until [ -f /etc/kubernetes/kubelet.conf ]; do
        if [ $n -ge 15 ]; then
            log::error_exit "/etc/kubernetes/kubelet.conf did not appear after 30 seconds" 1
        fi
        log::info "Waiting for /etc/kubernetes/kubelet.conf"
        sleep 2
        n=$((n + 1))
    done

    if ! grep -q 'server: https://127.0.0.1:6443' /etc/kubernetes/kubelet.conf; then
        sed -i 's/server: https:\/\/.*$/server: https:\/\/127.0.0.1:6443/g' /etc/kubernetes/kubelet.conf
        systemctl restart kubelet.service
    fi

    #

    if kubectl wait --kubeconfig /etc/kubernetes/kubelet.conf nodes my-node --for=condition=Ready --timeout 3m; then
        log::info "Node is Ready"
    else
        log::error "Node did not get READY yet, rebooting"
        reboot
    fi

    log::info "Script $0 finished"
    exit 0

  owner: root:root
  path: /usr/local/bin/node-bootstrap-script
  permissions: '0755'

bootcmd:
  - echo my-node > /etc/hostname
  - hostname my-node
runcmd:
  - /usr/local/bin/node-bootstrap-script