Aleksei Sviridkin e8631ae920 feat(cozystack-basics): restrict CA-source Secret writes to cert-manager ...

The CA-extraction controller's label-driven leg treats a core Secret
labelled internal.cozystack.io/publish-ca-cert as a trust-anchor source
and lifts its ca.crt into the tenant-readable projection. That label is
the whole attribution on that leg and sits on an ordinary Secret, so
without a platform-side control any principal that can write a Secret in
the namespace could forge a source or rewrite an existing one's ca.crt and
swap the trust anchor a tenant is handed as vouched.

Add a ValidatingAdmissionPolicy that allows a Secret carrying that label to
be created or updated only by cert-manager's controller ServiceAccount, the
sole legitimate writer of these Secrets. It covers both the forge-new
(CREATE) and tamper-existing (UPDATE, including a relabel-away evasion via
the old object) shapes, and by keying on the publish-ca-cert label it never
touches the declared-leg source, the projection, or any unlabelled Secret.

The allowed identity is pinned as a literal to the shipped cert-manager
package's controller ServiceAccount; a comment marks it as the fragile seam
that must move if cert-manager is repackaged.

Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-07-21 17:16:47 +03:00

..

apps

feat(postgres): publish the CA trust anchor to tenants

2026-07-21 17:16:47 +03:00

core

fix(platform): hand seaweedfs-db over for every instance name, not just the default

2026-07-20 15:40:48 +05:00

extra

docs(seaweedfs): correct the stale "D-wedged is adopted" comments

2026-07-20 15:40:49 +05:00

library

feat(cozy-lib): converge the trust-anchor helper on the canonical anchor

2026-07-21 17:16:47 +03:00

system

feat(cozystack-basics): restrict CA-source Secret writes to cert-manager

2026-07-21 17:16:47 +03:00

tests/cozy-lib-tests

feat(cozy-lib): converge the trust-anchor helper on the canonical anchor

2026-07-21 17:16:47 +03:00