younsl opened a new pull request, #439: URL: https://github.com/apache/superset-kubernetes-operator/pull/439
## Summary This PR clarifies how the security page treats the best-effort redaction of lifecycle task failure messages. It started from the discussion in [#437](https://github.com/apache/superset-kubernetes-operator/pull/437), where the redaction runs on arbitrary task output and can't see Secret values, so it can't cover every way a credential can appear. Until now, What Is In Scope listed any secret leaking into Events or status in Production mode, which made every redaction bypass read like a vulnerability that needs an expedited release. With this change, such bypasses are documented as hardening bugs that are fixed in regular releases. cc @villebro, as suggested in your review on #437. ## Details - What Is In Scope: the secret leak item now covers operator-managed Secret references (secretKeyFrom, metastore and Valkey From fields, and the other selectors under Secret Handling). - What Is Generally Out of Scope: new item for redaction bypasses in task failure output. A credential format that slips past the pattern-based redaction is a hardening bug, and fixes ship with the next regular release. - Task failure caveat: links to the new out-of-scope item, and asks users to give read access to Superset resources and Events following the Kubernetes [principle of least privilege](https://kubernetes.io/docs/concepts/security/rbac-good-practices/#least-privilege), since anyone with that access can see the failure messages. - No changelog entry, following the guideline for documentation-only changes. Verification: make lint-md (no issues) and mkdocs build --strict (no warnings). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
