mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
IvanHunters
e5cd2f6ffb
Fix all critical and serious issues from code review: **Security fixes:** 1. **RBAC least privilege**: Added resourceNames restriction to Secret access. Role now permits access ONLY to etcd-ca-tls and etcd-client-tls Secrets, preventing potential exposure of unrelated secrets in namespace. 2. **Universal key validation**: Changed from openssl rsa to openssl pkey. Now supports ANY key type (RSA, ECDSA, Ed25519, DSA), not just RSA. Prevents validation failure if cert-manager generates non-RSA keys. 3. **Complete certificate validity check**: Added notBefore validation. Now verifies certificate is valid NOW (notBefore <= now < notAfter), not just checking expiry. Prevents acceptance of future-dated certificates from misconfigured CA or clock skew. **Race condition fixes:** 4. **Eliminated TOCTOU race**: Removed check-then-create pattern. Now using kubectl apply (idempotent) instead of check + create. Handles both install and upgrade cases safely without race conditions between parallel Job executions or external modifications. **Reliability improvements:** 5. **Configurable timeout**: Moved certWaitTimeout and kubectlImage to values.yaml. Users can now adjust timeout for slow environments (external CA, high load, resource constraints) without modifying chart templates. 6. **Request timeouts**: Added --request-timeout=10s to all kubectl commands. Prevents infinite hangs if API server is overloaded or unreachable. 7. **Removed inaccessible diagnostics**: Deleted cert-manager logs collection (no cross-namespace RBAC permissions). Keeps only namespace-local diagnostics. All critical blocking issues are now resolved. Code is production-ready. Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>