Repository navigation
fix(guard): no strategy is issued a system: username; pin the system identities - #163
Merged
Merged
Conversation
…identities snowplow evaluates RBAC with a token's groups plus system:authenticated unless they hold system:unauthenticated or the username is system:anonymous (snowplow#1342), which is safe only because authn never issues those. Groups were already guarded for every strategy (checkSystemGroups); a system: username was refused only for identity sources (usernames.Reserved), and for basic and ServiceAccount identities was ruled out only by Kubernetes' object-name rules. The name guard and the exchange now refuse a system: username for every strategy (name_reserved), an explicit form of what the apiserver already rules out, so no valid name changes behaviour. TestNoStrategyIsIssuedASystemIdentity pins every strategy in both naming modes against system:authenticated, system:unauthenticated, system:anonymous and two other system: users; the exchange has its own test, and TestSystemGroupsAreRefused names the two groups. Mutation-checked: removing the guard from the name guard or the exchange fails a test. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NSM9VWrDcDtRDRTQoHjgV3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
acmp asked, for snowplow: can authn ever issue a JWT or client certificate whose groups hold
system:authenticatedorsystem:unauthenticated, or whose username issystem:anonymousor starts withsystem:? snowplow addssystem:authenticatedto a token's groups unless they holdsystem:unauthenticatedor the username issystem:anonymous(snowplow#1342). That is safe only if authn never issues those.From the code:
checkSystemGroups→ 403 SystemGroupNotAllowed.system:username was refused only for identity sources (usernames.Reserved, prefixsystem). For basic and ServiceAccount identities it was ruled out only by Kubernetes' object-name rules, since a name can't contain:.What
nameGuard.admit) and the exchange (VouchForExchange) refuse asystem:username for every strategy (name_reserved). This is the explicit form of what the apiserver already rules out, so no valid name changes behaviour.TestNoStrategyIsIssuedASystemIdentity: every strategy, both naming modes, refusingsystem:authenticatedandsystem:unauthenticatedgroups and thesystem:anonymous,system:serviceaccount:…andsystem:kube-schedulerusernames.TestNoExchangeVouchesForASystemUsername.TestSystemGroupsAreRefused, now naming the two groups.behavior.md, new section "Kubernetes system identities".Mutation-checked: removing the guard from either site fails a test.
🤖 Generated with Claude Code
https://claude.ai/code/session_01NSM9VWrDcDtRDRTQoHjgV3