Skip to content

feat: add ValidatingAdmissionPolicies to prevent privilege escalation via Authorino/AuthConfig specs #351

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DaliborD45 wants to merge 3 commits into
base: main
Choose a base branch
from
Open

feat: add ValidatingAdmissionPolicies to prevent privilege escalation via Authorino/AuthConfig specs #351

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
313e11a
feat: created VAP that blocks authorino.spec.image and limits authori…
DaliborD45 Aug 22, 2026
d095fc3
feat: refactored VAP file structure, created new one restricting to r…
DaliborD45 Aug 22, 2026
5938b84
feat: permissions on action is now granted by a cluster role
DaliborD45 Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,10 @@ CERT_MANAGER_VERSION ?= 1.12.1

manifests: controller-gen kustomize authorino-manifests ## Generate WebhookConfiguration, ClusterRole and CustomResourceDefinition objects.
$(CONTROLLER_GEN) crd rbac:roleName=authorino-operator-manager webhook paths="./..." output:crd:artifacts:config=config/crd/bases && $(KUSTOMIZE) build config/install > $(OPERATOR_MANIFESTS)
# ValidatingAdmissionPolicy/Binding are cluster-scoped. Build them on their own (no namespace
# overlay) and append, so this kustomize version does not stamp a namespace on them.
printf '%s\n' '---' >> $(OPERATOR_MANIFESTS)
$(KUSTOMIZE) build config/vap >> $(OPERATOR_MANIFESTS)
$(MAKE) deploy-manifest OPERATOR_IMAGE=$(OPERATOR_IMAGE)

.PHONY: authorino-manifests
Expand Down Expand Up @@ -314,6 +318,9 @@ deploy-manifest: kustomize
mkdir -p $(DEPLOYMENT_DIR)
cd $(PROJECT_DIR)/config/manager && $(KUSTOMIZE) edit set image controller=$(OPERATOR_IMAGE) ;\
cd $(PROJECT_DIR) && $(KUSTOMIZE) build config/deploy > $(DEPLOYMENT_FILE)
# ValidatingAdmissionPolicy/Binding are cluster-scoped; build separately (no namespace) and append.
printf '%s\n' '---' >> $(DEPLOYMENT_FILE)
$(KUSTOMIZE) build config/vap >> $(DEPLOYMENT_FILE)
# clean up
cd $(PROJECT_DIR)/config/manager && $(KUSTOMIZE) edit set image controller=${DEFAULT_OPERATOR_IMAGE}

Expand Down
113 changes: 113 additions & 0 deletions charts/authorino-operator/templates/manifests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3858,3 +3858,116 @@ spec:
runAsNonRoot: true
serviceAccountName: authorino-operator
terminationGracePeriodSeconds: 10
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: authorino-set-cluster-wide
rules:
- apiGroups:
- operator.authorino.kuadrant.io
resources:
- authorinos
verbs:
- set-cluster-wide
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: authorino-set-privileged-fields
rules:
- apiGroups:
- authorino.kuadrant.io
resources:
- authconfigs
verbs:
- set-privileged-fields
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: authconfig-restrict-all-namespaces
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups:
- authorino.kuadrant.io
apiVersions:
- v1beta3
operations:
- CREATE
- UPDATE
resources:
- authconfigs
validations:
- expression: '!variables.wantsAllNamespaces || variables.wasAllNamespaces || variables.isExempt'
message: 'allNamespaces: true (cluster-wide secret lookup) can only be set by
a subject granted the ''set-privileged-fields'' permission on authconfigs'
reason: Forbidden
variables:
- expression: authorizer.requestResource.check('set-privileged-fields').allowed()
name: isExempt
- expression: has(object.spec.authentication) && object.spec.authentication.exists(k,
(has(object.spec.authentication[k].apiKey) && has(object.spec.authentication[k].apiKey.allNamespaces)
&& object.spec.authentication[k].apiKey.allNamespaces) || (has(object.spec.authentication[k].x509)
&& has(object.spec.authentication[k].x509.allNamespaces) && object.spec.authentication[k].x509.allNamespaces))
name: wantsAllNamespaces
- expression: request.operation == 'UPDATE' && has(oldObject.spec.authentication)
&& oldObject.spec.authentication.exists(k, (has(oldObject.spec.authentication[k].apiKey)
&& has(oldObject.spec.authentication[k].apiKey.allNamespaces) && oldObject.spec.authentication[k].apiKey.allNamespaces)
|| (has(oldObject.spec.authentication[k].x509) && has(oldObject.spec.authentication[k].x509.allNamespaces)
&& oldObject.spec.authentication[k].x509.allNamespaces))
name: wasAllNamespaces
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: authorino-restrict-spec-fields
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups:
- operator.authorino.kuadrant.io
apiVersions:
- v1beta1
operations:
- CREATE
- UPDATE
resources:
- authorinos
validations:
- expression: '!has(object.spec.image) || object.spec.image == '''''
message: spec.image is not allowed; the Authorino image is controlled by the operator
reason: Invalid
- expression: '!variables.wantsClusterWide || variables.wasClusterWide || variables.isExempt'
message: 'spec.clusterWide: true can only be set by a subject granted the ''set-cluster-wide''
permission on authorinos'
reason: Invalid
variables:
- expression: authorizer.requestResource.check('set-cluster-wide').allowed()
name: isExempt
- expression: has(object.spec.clusterWide) && object.spec.clusterWide
name: wantsClusterWide
- expression: request.operation == 'UPDATE' && has(oldObject.spec.clusterWide) &&
oldObject.spec.clusterWide
name: wasClusterWide
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: authconfig-restrict-all-namespaces-binding
spec:
policyName: authconfig-restrict-all-namespaces
validationActions:
- Deny
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: authorino-restrict-spec-fields-binding
spec:
policyName: authorino-restrict-spec-fields
validationActions:
- Deny
Comment thread
DaliborD45 marked this conversation as resolved.
113 changes: 113 additions & 0 deletions config/deploy/manifests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3865,3 +3865,116 @@ spec:
runAsNonRoot: true
serviceAccountName: authorino-operator
terminationGracePeriodSeconds: 10
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: authorino-set-cluster-wide
rules:
- apiGroups:
- operator.authorino.kuadrant.io
resources:
- authorinos
verbs:
- set-cluster-wide
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: authorino-set-privileged-fields
rules:
- apiGroups:
- authorino.kuadrant.io
resources:
- authconfigs
verbs:
- set-privileged-fields
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: authconfig-restrict-all-namespaces
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups:
- authorino.kuadrant.io
apiVersions:
- v1beta3
operations:
- CREATE
- UPDATE
resources:
- authconfigs
validations:
- expression: '!variables.wantsAllNamespaces || variables.wasAllNamespaces || variables.isExempt'
message: 'allNamespaces: true (cluster-wide secret lookup) can only be set by
a subject granted the ''set-privileged-fields'' permission on authconfigs'
reason: Forbidden
variables:
- expression: authorizer.requestResource.check('set-privileged-fields').allowed()
name: isExempt
- expression: has(object.spec.authentication) && object.spec.authentication.exists(k,
(has(object.spec.authentication[k].apiKey) && has(object.spec.authentication[k].apiKey.allNamespaces)
&& object.spec.authentication[k].apiKey.allNamespaces) || (has(object.spec.authentication[k].x509)
&& has(object.spec.authentication[k].x509.allNamespaces) && object.spec.authentication[k].x509.allNamespaces))
name: wantsAllNamespaces
- expression: request.operation == 'UPDATE' && has(oldObject.spec.authentication)
&& oldObject.spec.authentication.exists(k, (has(oldObject.spec.authentication[k].apiKey)
&& has(oldObject.spec.authentication[k].apiKey.allNamespaces) && oldObject.spec.authentication[k].apiKey.allNamespaces)
|| (has(oldObject.spec.authentication[k].x509) && has(oldObject.spec.authentication[k].x509.allNamespaces)
&& oldObject.spec.authentication[k].x509.allNamespaces))
name: wasAllNamespaces
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: authorino-restrict-spec-fields
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups:
- operator.authorino.kuadrant.io
apiVersions:
- v1beta1
operations:
- CREATE
- UPDATE
resources:
- authorinos
validations:
- expression: '!has(object.spec.image) || object.spec.image == '''''
message: spec.image is not allowed; the Authorino image is controlled by the operator
reason: Invalid
- expression: '!variables.wantsClusterWide || variables.wasClusterWide || variables.isExempt'
message: 'spec.clusterWide: true can only be set by a subject granted the ''set-cluster-wide''
permission on authorinos'
reason: Invalid
variables:
- expression: authorizer.requestResource.check('set-cluster-wide').allowed()
name: isExempt
- expression: has(object.spec.clusterWide) && object.spec.clusterWide
name: wantsClusterWide
- expression: request.operation == 'UPDATE' && has(oldObject.spec.clusterWide) &&
oldObject.spec.clusterWide
name: wasClusterWide
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: authconfig-restrict-all-namespaces-binding
spec:
policyName: authconfig-restrict-all-namespaces
validationActions:
- Deny
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: authorino-restrict-spec-fields-binding
spec:
policyName: authorino-restrict-spec-fields
validationActions:
- Deny
113 changes: 113 additions & 0 deletions config/install/manifests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -544,3 +544,116 @@ subjects:
- kind: ServiceAccount
name: authorino-operator
namespace: authorino-operator
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: authorino-set-cluster-wide
rules:
- apiGroups:
- operator.authorino.kuadrant.io
resources:
- authorinos
verbs:
- set-cluster-wide
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: authorino-set-privileged-fields
rules:
- apiGroups:
- authorino.kuadrant.io
resources:
- authconfigs
verbs:
- set-privileged-fields
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: authconfig-restrict-all-namespaces
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups:
- authorino.kuadrant.io
apiVersions:
- v1beta3
operations:
- CREATE
- UPDATE
resources:
- authconfigs
validations:
- expression: '!variables.wantsAllNamespaces || variables.wasAllNamespaces || variables.isExempt'
message: 'allNamespaces: true (cluster-wide secret lookup) can only be set by
a subject granted the ''set-privileged-fields'' permission on authconfigs'
reason: Forbidden
variables:
- expression: authorizer.requestResource.check('set-privileged-fields').allowed()
name: isExempt
- expression: has(object.spec.authentication) && object.spec.authentication.exists(k,
(has(object.spec.authentication[k].apiKey) && has(object.spec.authentication[k].apiKey.allNamespaces)
&& object.spec.authentication[k].apiKey.allNamespaces) || (has(object.spec.authentication[k].x509)
&& has(object.spec.authentication[k].x509.allNamespaces) && object.spec.authentication[k].x509.allNamespaces))
name: wantsAllNamespaces
- expression: request.operation == 'UPDATE' && has(oldObject.spec.authentication)
&& oldObject.spec.authentication.exists(k, (has(oldObject.spec.authentication[k].apiKey)
&& has(oldObject.spec.authentication[k].apiKey.allNamespaces) && oldObject.spec.authentication[k].apiKey.allNamespaces)
|| (has(oldObject.spec.authentication[k].x509) && has(oldObject.spec.authentication[k].x509.allNamespaces)
&& oldObject.spec.authentication[k].x509.allNamespaces))
name: wasAllNamespaces
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: authorino-restrict-spec-fields
spec:
failurePolicy: Fail
matchConstraints:
resourceRules:
- apiGroups:
- operator.authorino.kuadrant.io
apiVersions:
- v1beta1
operations:
- CREATE
- UPDATE
resources:
- authorinos
validations:
- expression: '!has(object.spec.image) || object.spec.image == '''''
message: spec.image is not allowed; the Authorino image is controlled by the operator
reason: Invalid
- expression: '!variables.wantsClusterWide || variables.wasClusterWide || variables.isExempt'
message: 'spec.clusterWide: true can only be set by a subject granted the ''set-cluster-wide''
permission on authorinos'
reason: Invalid
variables:
- expression: authorizer.requestResource.check('set-cluster-wide').allowed()
name: isExempt
- expression: has(object.spec.clusterWide) && object.spec.clusterWide
name: wantsClusterWide
- expression: request.operation == 'UPDATE' && has(oldObject.spec.clusterWide) &&
oldObject.spec.clusterWide
name: wasClusterWide
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: authconfig-restrict-all-namespaces-binding
spec:
policyName: authconfig-restrict-all-namespaces
validationActions:
- Deny
---
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: authorino-restrict-spec-fields-binding
spec:
policyName: authorino-restrict-spec-fields
validationActions:
- Deny
7 changes: 7 additions & 0 deletions config/vap/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- restrict-spec-fields.yaml
- restrict-all-namespaces.yaml
- set-privileged-fields-role.yaml
- set-cluster-wide-role.yaml
Comment thread
DaliborD45 marked this conversation as resolved.
Loading
Loading