stackabletech / stackabletech/secret-operator
k8sSearch: exclude secrets with scopes that are not requested
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 13
- Forks
- 8
- Avg merge
- 1d 8h
- Merged PRs (30d)
- 10
Description
Affected Stackable version
nightly
Current and expected behavior
Currently, the k8sSearch backend treats requested scopes as a minimum bound. A volume that requests pod will happily be supplied a secret secret that provides pod,node, allowing the pod to impersonate someone else.
Possible solution
k8sSearch should reject secrets that specify unrequested scopes.
Additional context
No response
Environment
No response
Would you like to work on fixing this bug?
None
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the k8sSearch backend named in the issue and trace how requested scopes are compared with scopes on candidate secrets. Done means secrets containing any unrequested scope are rejected, while secrets whose scopes are all requested remain eligible; add regression coverage for both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, rust
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100