villebro opened a new pull request, #327: URL: https://github.com/apache/superset-kubernetes-operator/pull/327
## Summary A Claude security scan noted that several environment-dependent guarantees were enforced only at CEL admission, evaluated once against the incoming object, with no controller-side re-check — unlike `createDatabaseEnabled`, which already re-verifies its preconditions in Go "defensive against … older CRD versions, direct etcd writes, missing CEL on the apiserver." This applies that same standard uniformly. ## Details - **No transition rules.** `environment` was freely mutable, so a single update could flip Production → Staging (re-arming the destructive seed against the unchanged production metastore references) or → Development (re-admitting inline secrets on a live instance). A new CEL transition rule (`oldSelf`) rejects any in-place change of `environment` out of Production; the defaulted-absent form counts as Production. The opt-out is delete-and-recreate. - **Missing Development re-check on inline-secret literals.** `secretKey`/`valkey.password` were already gated on `isDev`, but the metastore URI/password, seed source and target passwords, and the create-database password literal branches were emitted unconditionally. They now share an `isDevEnvironment` helper: outside Development the inline value is dropped and only the `*From` reference is honored. Pure defense in depth — it only bites if CEL is absent or skewed. - **Destructive seed had no controller-side guard.** The default seed script opens with `DROP DATABASE`, yet nothing on the lifecycle path consulted `spec.environment`. `reconcileLifecycle` now runs `gateOnSeedEnvironment` alongside `gateOnInvalidSeedSchedule`: seed present and not disabled but environment not Development/Staging blocks the pipeline with a `SeedEnvironmentNotAllowed` condition, Blocked phase, and Warning event — the seed Job is never created. ## Release notes - A Production Superset CR can no longer be downgraded in place to Development or Staging; delete and recreate the instance to change environment out of Production. Upgrades toward Production and non-Production transitions are unaffected. Found via a Claude security scan. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
