miki3421 opened a new pull request, #140: URL: https://github.com/apache/openserverless-operator/pull/140
Redis tenant accounts in 0.9.0 receive `+@all`: key-prefix restrictions do not restrict administrative commands or global key/channel operations. This change replaces tenant grants with a shared restricted policy during provisioning, reconciliation and quota transitions. The policy resets legacy key/channel grants and ACL selectors, restricts keys and Pub/Sub channels to the tenant prefix, and denies administration, global enumeration, function management and global script-management commands. Application Lua remains available through EVAL/EVALSHA, their read-only variants, SCRIPT LOAD and SCRIPT EXISTS; scripts remain subject to the caller's command and key permissions. Quota recovery restores tenant writes without restoring `+@all`. Provisioning uses structured Redis commands and password hashes instead of interpolating tenant credentials into a CLI script. The legacy template permits its broad internal grant only for the explicitly selected OpenServerless system account. Existing tenant credentials, profile fields, Redis version, data and volumes are preserved. ACLs are saved when an ACL file is configured, preserving the existing 0.9.0 startup-reconciliation contract otherwise. Existing installations must reconcile their existing tenants to replace legacy grants; changing the operator image alone does not rewrite every existing identity. Validation: - 12 focused unit tests passed; added to the pull-request Check workflow. - 46 live lifecycle/security checks passed again on the patched 0.9.0 K3s lab: provisioning and reconciliation, stale selectors, peer-key/channel denial, Lua, Pub/Sub, quota enter/exit, credential compatibility and deletion with data retention. Dangerous commands were checked with administrator-side ACL DRYRUN rather than executing them. - The four production modules/templates match the installed baseline operator source by SHA-256. - Alpha and Beta application checks passed on both patched K3s labs with application source unchanged. The optional live test requires an explicit `--lab` flag and is not run by unit-test discovery. This PR contains only the 0.9.0 authorization backport and its tests; it does not upgrade Redis or include Advanced component changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
