villebro opened a new pull request, #279:
URL: https://github.com/apache/superset-kubernetes-operator/pull/279
## Summary
The Celery Flower default command ships **without authentication**, and its
dashboard discloses task names, arguments, and results metadata — for Superset
that includes other users' async SQL Lab statements and alert/report payloads.
The operator, however, unconditionally fanned `/flower` onto the end-user
Ingress/Gateway hostname whenever `celeryFlower` was set, and opened Flower's
port to **all sources** in the built-in NetworkPolicy. This publishes an
unauthenticated admin UI on the untrusted end-user surface with no documented
hardening requirement.
This makes external publication **environment-aware**, matching the
operator's existing Production/Staging/Development model.
## Details
- In **Production** (the default), Flower is excluded from the external
Ingress/Gateway fan-out and the all-sources NetworkPolicy rule **unless** the
CR author explicitly sets `celeryFlower.service.gatewayPath`. Setting it is the
author's assertion that authentication is in front of Flower (e.g.
`FLOWER_BASIC_AUTH` injected from a Secret via
`celeryFlower.podTemplate.container.env`, or ingress-layer auth).
- **Development** and **Staging** keep the convenient auto-publish, so
existing dev/staging deployments, samples, and e2e are unaffected.
- `flowerRoutePublished` gates both the route (`networking.go`) and the
NetworkPolicy external port (`networkpolicy.go`).
- Docs: networking user guide (route + NetworkPolicy tables, fan-out note,
and a hardening warning explaining how to wire `FLOWER_BASIC_AUTH`), security
Design Decisions, and the `GatewayPath` API doc comment; regenerated API
reference.
- Tests: environment-aware gate (`flowerRoutePublished`) across environment
× opt-in, and the gated NetworkPolicy port (`flowerExternalPort`).
## ⚠️ Breaking change
Production CRs that relied on bare `celeryFlower: {}` plus Ingress/Gateway
to expose `/flower` will no longer publish it. Add
`celeryFlower.service.gatewayPath` (e.g. `/flower`) to restore publication —
after putting authentication in front of Flower. Pre-1.0 (`v1alpha1`), so this
is acceptable; called out as a release note.
## Testing
- `go build ./...`, `gofmt`, `golangci-lint run` clean
- `go test ./internal/controller/... ./internal/resolution/...` passes,
including the new `TestFlowerRoutePublished_EnvironmentAware` and
`TestFlowerExternalPort_GatedByPublish`
- `make docs-api` regenerated the API reference; no CRD manifest drift
(`maxDescLen=0`)
---
Found via a Claude security scan. Part of a series of security follow-ups;
opened as a draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
