The GitHub Actions job "Required Checks" on texera.git/feat/mount-A-infra has failed. Run started by GitHub user aicam (triggered by aicam).
Head commit for run: eda41ff5d6cdd1078fe6d5fe3ced6edd179d2315 / ali <[email protected]> feat(dataset-mount): authenticate mounter callers with TokenReview The mounter runs privileged on every node with a hostPath and Bidirectional mount propagation, and listens on a hostPort, so anything routable to a node IP could previously ask it to mount -- including computing-unit pods running untrusted user code. Callers now present a service-account token projected for the mounter's audience. The mounter verifies it with the TokenReview API and requires the identity to match its allow-list; an unreachable API server is a denial, not a fallback. Enforcement sits with the API server rather than a NetworkPolicy, which is silently unenforced on CNIs that do not implement it and is bypassed by hostPort traffic anyway, since that is DNAT'd at the node where pod selectors no longer apply. The permitted caller is access-control-service, the component that already decides whether a user may act on a computing unit. The mounter cannot make that call itself -- every request arrives under one service identity, so it cannot tell whose workflow is asking -- which is why the component that does know must be the only one able to ask. The identity is fixed in the chart rather than exposed in values.yaml: widening it is a security decision, not a deployment preference. The computing-unit pod no longer receives the mounter's address. NODE_IP and TEXERA_MOUNTER_PORT are removed; a pod that wants a mount asks the platform, which authorizes the (user, cuid) pair first. Path validation stays in the mounter regardless of who is calling: authenticating the caller establishes who is asking, not that the path they asked for is safe. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_012DAsFEeKy8naiieegupNp5 Report URL: https://github.com/apache/texera/actions/runs/32786042979 With regards, GitHub Actions via GitBox
