miki3421 opened a new pull request, #146: URL: https://github.com/apache/openserverless-operator/pull/146
## Problem and change Related to apache/openserverless#277. Companion task PR: apache/openserverless-task#239. Both changes should ship together. An ordinary tenant action can reach shared monitoring APIs when optional monitoring is enabled. Prometheus additionally exposes a fixed NodePort and administrative API, while kube-state-metrics collects Secret metadata. This patch: - Removes the Prometheus NodePort and admin API, preserving loopback config reload and authorized administrative port-forward. - Restricts monitoring ingress with NetworkPolicies, including exclusion of invoker-marked action pods from trusted selectors. - Removes Secret collection and collector Secret RBAC. - Applies policies before workloads, rolls legacy pods once, waits for readiness and reconciles on resume/update. - Retains policies until protected pods terminate during explicit component removal. Component versions, Alertmanager receivers and Alpha/Beta source code are unchanged. See `MONITORING_SECURITY.md` for the access matrix, upgrade procedure and limitations. ## Validation - 88/88 operator unit tests passed on this candidate based on current Apache `0.9.0`, including 11 monitoring tests. - 45/45 live K3s boundary/functional checks passed with the reviewed monitoring patch, covering tenant Service/pod-IP access denial, forged labels, foreign namespaces, legitimate scrape/alert delivery, reload, disabled admin API, absent NodePort and reduced RBAC. - Existing-cluster Alpha/Beta checks: 15/15; Redis Lua 84/84; Streamer 24/24. Application source hashes preserved and scheduled heartbeats continued. - Operator resume preserved pod identities/readiness. - Focused Daybreak reviews of both local patches completed without reportable findings. - Paired task/operator RBAC manifests match byte-for-byte; diff whitespace checks pass. ## Requirements and limitations NetworkPolicy enforcement is required; ordinary Kind networking without enforcement does not establish tenant isolation. Broad administrator-created allow policies and compromised trusted control-plane pods remain outside this boundary. Install the companion task changes to reconcile cluster-scoped RBAC. Image-only upgrades require an administrator to apply the updated monitoring role first. This iteration validates an existing K3s installation, not a fresh full installation or the exact public update command against a released image. Whole-Whisk garbage collection still has no guaranteed policy-last teardown ordering. Receiver credentials stored in ConfigMaps remain separate hardening for principals already authorized to read cluster configuration. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
