villebro opened a new pull request, #278: URL: https://github.com/apache/superset-kubernetes-operator/pull/278
## Summary The operator relies on `superset.apache.org/*` pod labels for isolation and lifecycle-task tracking (`superset.apache.org/parent` drives the per-instance NetworkPolicy ingress selector; `superset.apache.org/instance` tracks task pods). Two paths let a user holding only `supersets` write forge these labels and interfere across instances. This closes both and documents the guarantee. ## Details **Task-pod health check trusted a spoofable label.** `taskPodStartupError` attributed pod state to a lifecycle task purely by `superset.apache.org/instance`, which is forced only on task-Job pods (it is not in `podOperatorLabels`). A wedged pod planted by another CR via `podTemplate.labels` could inject its attacker-chosen kubelet message into the victim CR's task status, `LifecycleComplete` condition, and Warning Events. Pod state is now attributed only when the pod is controller-owned by that task's Job (`metav1.IsControlledBy`) — an ownerReference a pod author cannot forge. **Reserved labels were forgeable on pods.** `MergePodTemplate` now strips user-supplied `superset.apache.org/*`-prefixed labels before folding in the operator labels, so a component `podTemplate` cannot smuggle discovery/isolation labels onto its pods. The maintenance-page path builds its pod spec outside the resolver, so it did not benefit — it now forces `podOperatorLabels` (including `superset.apache.org/parent`) and strips reserved user labels via the shared `resolution.ForceOperatorPodLabels` helper. Without this, a maintenance `podTemplate` could carry a forged `parent` label and land inside another instance's per-instance NetworkPolicy ingress isolation. Documents in `docs/reference/security.md` that reserved `superset.apache.org/*` pod labels are unforgeable, so instance ingress isolation holds against CR authors, not only against compromised workload pods. Also drops the now-dead `taskName` parameter of `handleStuckTaskPod`. Adds regression tests for the foreign-pod ownerReference filter, reserved-label stripping in `MergePodTemplate`, and the maintenance-path label forcing. ## Testing - `go build ./...`, `gofmt`, `golangci-lint run` clean - `go test ./internal/controller/... ./internal/resolution/...` passes, including the new tests --- Found via a Claude security scan. Part of a series of security follow-ups; opened as a draft. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
