mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
Aleksei Sviridkin
37a91f98b8
Every catalog engine issues a per-release CA, but the object holding ca.crt usually holds a private key beside it (cert-manager's tls.key, CloudNativePG's ca.key), so granting a tenant read on it hands over key material too. Add a controller that publishes the trust anchor as one canonical, key-free Secret per release, "<release>.tenant-ca", holding only ca.crt. A chart declares the anchor by rendering a namespaced TenantProjection sentinel (internal.cozystack.io/v1alpha1) that names the source Secret and key. The controller rebuilds ca.crt from the parsed certificate DER rather than copying the source, refuses any value carrying private key material, and owns the projection by owner reference so a foreign Secret at the same name is never overwritten. No tenant RBAC grants any verb on internal.cozystack.io; a ValidatingAdmissionPolicy pins writes to helm-controller as defence in depth. The controller does not grant tenant read access — the lineage webhook does, from the ApplicationDefinition's spec.secrets. This side stamps the engine-agnostic internal.cozystack.io/tenant-ca label and forces a re-admission when those selectors change. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
40 lines
1.4 KiB
Go
40 lines
1.4 KiB
Go
/*
|
|
Copyright 2026 The Cozystack Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
// Package v1alpha1 contains API Schema definitions for the
|
|
// internal.cozystack.io v1alpha1 API group. No tenant RBAC role grants any
|
|
// verb on this group, so objects in it are platform-internal sentinels that
|
|
// tenants cannot forge.
|
|
// +kubebuilder:object:generate=true
|
|
// +groupName=internal.cozystack.io
|
|
package v1alpha1
|
|
|
|
import (
|
|
"k8s.io/apimachinery/pkg/runtime/schema"
|
|
"sigs.k8s.io/controller-runtime/pkg/scheme"
|
|
)
|
|
|
|
var (
|
|
// GroupVersion is group version used to register these objects.
|
|
GroupVersion = schema.GroupVersion{Group: "internal.cozystack.io", Version: "v1alpha1"}
|
|
|
|
// SchemeBuilder is used to add go types to the GroupVersionKind scheme.
|
|
SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}
|
|
|
|
// AddToScheme adds the types in this group-version to the given scheme.
|
|
AddToScheme = SchemeBuilder.AddToScheme
|
|
)
|