miki3421 opened a new pull request, #141: URL: https://github.com/apache/openserverless-operator/pull/141
The 0.9.0 deployment uses a repository-shipped etcd JWT signing key, exposes etcd administrator credentials in Milvus configuration, publishes Milvus metrics through a NodePort, and includes configuration values in DEBUG logs. This patch addresses these paths together while retaining the 0.9.0 etcd/Milvus engine versions and persistent data layout. - Generate and retain an installation-specific RSA-3072 signing key in a new Secret; refuse implicit replacement of invalid or missing signing state on an already patched installation. Exclude stale shared-key manifests in the persistent deploy directory and remove the old live Secret after etcd rollout. - Store full/slim Milvus configuration in a Secret and mount it read-only. Use a dedicated etcd identity with READWRITE permission only under `milvus/`, plus READ on the literal `health` key required by Milvus 2.5.2 startup. Refuse existing identities with unexpected roles or broader permissions. Remove the old ConfigMap only after the Secret-backed Deployment is ready. - Change Milvus Services to ClusterIP and add ingress NetworkPolicies: etcd clients are operator/Milvus/members, peer traffic is members only, and Milvus metrics are limited to operator/Prometheus. Authenticated Milvus application traffic remains available on port 19530. Add the namespaced operator permissions required to reconcile these policies. - Log configuration key names without values; apply Secret resources through a private wrapper that does not report credential-bearing payloads or stderr on failure. The transition also verifies and preserves an existing Milvus system user instead of recreating it during reconciliation. It never resets that account after an authentication failure. Validation: - 13 focused regression tests passed again locally; added to the pull-request Check workflow. Full/slim Secret rendering includes punctuation and newline credentials. - Both existing full K3s labs passed 15 live security checks, tenant-runtime network denial checks and legitimate Prometheus/API connectivity checks. - Alpha/Beta: 15/15 application checks before and after on each lab, without editing or redeploying application code. Existing fixtures, PVC/PV bindings and Service identities were preserved; all three etcd members and Milvus were Ready at completion. - The seven production modules/templates match the installed 0.9.0 operator source by SHA-256. The Advanced port was exercised separately; this PR contains only the 0.9.0 backport. Operational considerations: NetworkPolicies require an enforcing CNI (tested with K3s); no fresh slim installation or live Kind run was performed for this patch. Kubernetes Secret-read and administrator privileges remain privileged. Baseline etcd transport remains unchanged. Operators of existing installations should rotate previously exposed etcd root and other affected credentials separately after reconciling etcd and Milvus; passwords were rotated and the etcd probe environments refreshed in both test labs. Automatic credential rotation or data migration is not part of this PR. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
