· javascript
Shopify Overexposed Scans GKE Ingresses and Cloud Run for Exposure
This internal scanner locates Kubernetes Ingresses on GKE and Cloud Run services.
It checks for those that are accessible from the internet without authentication. After a first version based on repository config files produced false alarms and blind spots, the team rebuilt it on GCP Cloud Asset Inventory and an anonymous HTTP probe. In just a few weeks of tuning, this reduced inconclusive Ingress verdicts by around 80%.
The original scanner checked the infrastructure repository for Ingresses. It focused on public hostnames without authentication settings and then probed them. Shopify says this failed in three ways.
Teams that configured proxy authentication annotations directly triggered false positives. Admission controllers that rewrite settings at admission time, but do not run in every cluster, meant a correct-looking config could have no effect. Ingresses created by other repositories or platform tooling were never seen.
The authors summarize the lesson as: the repository shows intent; the cluster shows what is enforced. The current version follows a schedule.
