mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
IvanHunters
88b41eca1d
Fix critical security and operational issues from final review:
**CRITICAL SECURITY: Prevent TLS private key leakage**
1. **Remove Secret data from diagnostics**: Changed kubectl get secret -o yaml
to -o jsonpath='{.metadata}'. Previous implementation logged base64-encoded
TLS certificates and PRIVATE KEYS to Pod logs, accessible to any user with
kubectl logs permissions. This is a critical security vulnerability.
Now only metadata (names, labels, annotations) is shown, no sensitive data.
**Operational reliability: Fail-fast on broken cert-manager**
2. **Add Certificate CR validation**: New check_certificate_ready function
verifies Certificate CRs exist and are not in permanent "Failed" state
before entering wait loop. Prevents Job from wasting 50+ minutes (10 retries
× 300s timeout) when cert-manager is broken (misconfigured Issuer, CA
unavailable, RBAC issues). Job now fails immediately with clear diagnostic
output showing Certificate failure reason.
**Simplification: Remove redundant validation**
3. **Remove notBefore client-side check**: Eliminated complex date parsing
logic with GNU coreutils dependency. This validation is redundant - Kamaji
ValidatingWebhook performs TLS handshake validation at admission time,
checking full certificate validity window server-side. Client-side check
added complexity without real benefit and introduced TOCTOU race condition.
Now rely on server-side validation (atomic operation).
4. **Remove coreutils dependency**: No longer needed after removing notBefore
check. Reduces apk install time and image size, eliminates potential
version conflicts between BusyBox and GNU utilities.
All critical security and operational issues resolved. Job is production-ready
with no sensitive data leakage and fast failure on cert-manager issues.
Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>