Aleksei Sviridkin e8631ae920
feat(cozystack-basics): restrict CA-source Secret writes to cert-manager ...
The CA-extraction controller's label-driven leg treats a core Secret
labelled internal.cozystack.io/publish-ca-cert as a trust-anchor source
and lifts its ca.crt into the tenant-readable projection. That label is
the whole attribution on that leg and sits on an ordinary Secret, so
without a platform-side control any principal that can write a Secret in
the namespace could forge a source or rewrite an existing one's ca.crt and
swap the trust anchor a tenant is handed as vouched.
Add a ValidatingAdmissionPolicy that allows a Secret carrying that label to
be created or updated only by cert-manager's controller ServiceAccount, the
sole legitimate writer of these Secrets. It covers both the forge-new
(CREATE) and tamper-existing (UPDATE, including a relabel-away evasion via
the old object) shapes, and by keying on the publish-ca-cert label it never
touches the declared-leg source, the projection, or any unlabelled Secret.
The allowed identity is pinned as a literal to the shipped cert-manager
package's controller ServiceAccount; a comment marks it as the fragile seam
that must move if cert-manager is repackaged.
Signed-off-by: Aleksei Sviridkin <f@lex.la >
2026-07-21 17:16:47 +03:00
2026-07-21 17:16:46 +03:00
2026-07-10 05:29:23 +00:00
2026-07-21 17:02:37 +05:00
2026-01-19 13:59:29 +01:00
2026-03-25 15:57:25 +05:00
2026-07-10 05:29:23 +00:00
2026-06-02 16:42:58 +03:00
2026-01-15 16:06:56 +01:00
2026-06-23 14:45:53 +05:00
2026-06-18 10:40:05 +05:00
2026-07-10 05:29:23 +00:00
2026-05-21 12:57:02 +05:00
2026-07-20 00:20:06 +03:00
2026-05-03 20:49:47 +05:00
2026-05-26 14:18:22 +05:00
2026-07-10 05:29:23 +00:00
2026-05-29 11:07:19 +03:00
2026-01-15 16:06:56 +01:00
2026-06-02 16:42:58 +03:00
2026-02-14 11:42:52 +01:00
2026-02-10 22:47:20 +05:00
2026-06-22 21:46:49 +03:00
2026-04-28 11:14:27 +02:00
2026-07-10 05:29:23 +00:00
2026-07-21 17:16:47 +03:00
2026-07-21 17:16:46 +03:00
2026-04-13 17:15:09 +03:00
2026-07-14 14:22:46 +03:00
2026-07-15 19:11:36 +05:00
2026-07-06 14:41:33 +04:00
2026-07-06 14:41:33 +04:00
2026-07-03 19:14:15 +03:00
2026-05-25 19:11:52 +03:00
2026-07-20 04:49:57 +03:00
2026-07-10 05:29:23 +00:00
2026-07-10 05:29:23 +00:00
2026-07-14 13:10:59 +03:00
2026-05-31 19:04:20 +05:00
2026-06-23 03:47:31 +03:00
2026-06-02 16:42:58 +03:00
2026-05-25 17:07:02 +03:00
2026-07-03 19:14:27 +03:00
2026-06-08 16:58:51 +03:00
2026-07-10 05:29:23 +00:00
2026-06-22 19:09:10 +03:00
2026-06-22 10:57:27 +03:00
2026-06-02 16:42:58 +03:00
2026-04-23 16:57:23 +05:00
2026-06-02 16:42:58 +03:00
2026-01-19 13:59:29 +01:00
2026-03-02 12:35:14 +05:00
2026-06-09 12:50:35 +03:00
2026-01-15 16:06:56 +01:00
2026-06-02 16:42:58 +03:00
2026-07-10 05:29:23 +00:00
2026-07-21 14:45:52 +04:00
2026-07-01 20:25:15 +02:00
2026-07-10 05:29:23 +00:00
2026-07-10 05:29:23 +00:00
2026-06-25 02:38:05 +03:00
2026-07-10 05:29:23 +00:00
2026-07-10 05:29:23 +00:00
2026-07-13 12:22:38 +05:00
2026-05-14 16:49:00 +03:00
2026-06-08 17:15:00 +03:00
2026-07-03 19:14:33 +03:00
2026-05-25 11:54:45 +05:00
2026-06-26 21:20:30 +05:00
2026-07-06 09:49:50 +05:00
2026-06-24 15:50:36 +03:00
2026-07-10 05:29:23 +00:00
2026-07-10 05:29:23 +00:00
2026-07-14 14:22:46 +03:00
2026-07-16 16:57:41 +03:00
2026-02-10 20:19:03 +01:00
2026-01-15 16:06:56 +01:00
2026-07-02 15:48:29 +03:00
2026-07-10 05:29:23 +00:00
2026-07-20 05:24:04 +03:00
2026-06-22 18:55:38 +03:00
2026-06-02 16:42:58 +03:00
2026-07-15 15:31:45 +03:00
2026-06-24 23:38:38 +03:00
2026-07-15 15:31:45 +03:00
2026-07-10 05:29:23 +00:00
2026-06-22 20:05:54 +03:00
2026-06-02 16:42:58 +03:00
2026-06-22 18:51:06 +03:00
2026-07-10 05:29:23 +00:00
2026-06-23 03:25:16 +03:00
2026-06-02 16:42:58 +03:00
2026-06-23 14:39:14 +03:00
2026-07-20 11:33:35 +05:00
2026-06-02 16:42:58 +03:00
2026-07-16 16:18:37 +03:00
2026-03-25 16:11:14 +03:00
2026-02-11 22:54:56 +01:00
2026-07-16 21:44:41 +04:00
2026-07-21 17:16:47 +03:00
2026-06-16 14:19:47 +05:00
2026-02-06 13:30:58 +03:00
2026-06-02 16:42:58 +03:00
2026-01-15 16:06:56 +01:00
2026-06-02 16:42:58 +03:00
2026-07-10 05:29:23 +00:00
2026-06-02 16:42:58 +03:00
2026-07-03 19:14:21 +03:00
2026-07-20 15:40:49 +05:00
2026-05-31 15:02:33 +05:00
2026-05-11 21:08:41 +03:00
2026-07-10 05:29:23 +00:00
2026-01-15 16:06:56 +01:00
2026-05-11 21:08:41 +03:00
2026-01-15 16:06:56 +01:00
2026-05-28 12:46:57 +05:00
2026-07-01 06:04:22 +03:00
2026-07-03 16:04:46 +03:00
2026-01-15 16:06:56 +01:00
2026-04-20 15:48:53 +03:00
2026-03-25 15:59:22 +05:00
2026-06-25 12:56:49 +05:00
2026-06-02 16:42:58 +03:00
2026-06-02 16:42:58 +03:00
2026-05-11 21:08:41 +03:00
2026-01-15 16:06:56 +01:00
2026-01-15 16:06:56 +01:00
Aleksei Sviridkin
e8631ae920