Epic: Security hardening for 0.1.0 assessment findings

Tracking epic for the security findings from the static assessment of nebari-data-science-pack 0.1.0 (pinned commit 69c84f72df259ec755ed40bfc83f20158c550d55, release tag nebari-data-science-pack-0.1.0).

Every finding below was re-validated against current main (HEAD f932d80) before filing. All 16 still stand; one (M-06) has partially shifted since the assessed commit but the underlying issue remains. Each item is tracked as its own sub-issue with area: security and a priority label. The findings are independent and each sub-issue is self-contained.

The pack is declared experimental. This epic collects the hardening work needed before it can be treated as a production baseline.

Severity summary

High priority

• #163 - H-01: default user role and japps service carry credential-admin scopes (admin:auth_state/tokens)
• #164 - H-02: chart fails open to DummyAuthenticator when OAuth URLs / config mount are absent
• #165 - H-03: hierarchical Keycloak group paths collapse to leaf name, merging storage/profile principals
• #166 - H-04: privileged in-cluster NFS server (abandoned-image repack) enabled by default
• #167 - H-05: RBAC bootstrap Job runs a mutable image with the Keycloak master-realm admin password
• #168 - H-06: runtime and release artifacts use mutable tags without signatures, provenance, or SBOM

Medium priority

• #169 - M-01: Keycloak group names interpolated unquoted into a root sh -c init command
• #170 - M-02: authorization revocation fails open on Keycloak refresh / Admin API errors
• #171 - M-03: missing role-filter state falls back to mounting every group in the token
• #172 - M-04: optional NFS client-installer DaemonSet mutates every node with host privileges
• #173 - M-05: Nebi workspace selection is shell-interpolated and init failures are masked
• #174 - M-06: inconsistent software inventory with no dependency / vuln / SBOM gate
• #175 - M-07: Hub OIDC login credential reused for Admin API and forwarded to japps with broad realm roles
• #176 - M-08: every authenticated realm user is admitted by default (allow_all = True)

Low priority

• #177 - L-01: auth diagnostics log identity and token-presence metadata (sub, scope, key names)
• #178 - L-02: Hub-to-Nebi egress NetworkPolicy selects an entire namespace with no pod selector

Suggested sequencing

Roughly aligned with the assessment's remediation plan, though each sub-issue can be worked independently:

1. Identity and auth scopes: #163, #164, #176, #175
2. Storage and execution boundaries: #165, #169, #171, #173, #170
3. Privileged workloads: #166, #167, #172
4. Supply chain and release engineering: #168, #174
5. Hardening and hygiene: #177, #178

Related existing issues

• #129 overlaps parts of #166, #167, and #172 (it asks to document the privileged NFS containers and set a securityContext on the RBAC bootstrap Job). The security issues here are broader; #129 can be consolidated into them or closed once they land.
• #133 relates to #164 (hub behavior on a missing OAuth secret).
• #29 is the tracked exit plan for the in-cluster NFS server (#166, #172).
• #120 (Beta release readiness) is the broader release epic this security work feeds into.

Start with the independently scoped sub-issues #163–#178 and their referenced findings; this epic does not name implementation files or tests. Review the affected authentication, workload, networking, and release areas through those sub-issues. The epic is complete when all 16 findings have been addressed or explicitly consolidated.