You are viewing a plain text version of this content. The canonical link for it is here.
Posted to reviews@kudu.apache.org by "Anonymous Coward (Code Review)" <ge...@cloudera.org> on 2026/06/08 09:46:30 UTC
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
jarek@potiuk.com has uploaded this change for review. ( http://gerrit.cloudera.org:8080/24413
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
Adds a v0 security threat model (THREAT_MODEL.md), a SECURITY.md disclosure
pointer to it, and an AGENTS.md entry point so the AGENTS.md -> SECURITY.md ->
THREAT_MODEL.md discoverability chain resolves for automated tooling. The
threat model is a provenance-tagged v0 draft for the PMC to review (see the
open questions in its section 14).
Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Generated-by: Claude Code (Claude Opus 4.8)
---
A AGENTS.md
A SECURITY.md
A THREAT_MODEL.md
3 files changed, 427 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/13/24413/1
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newchange
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 1
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 1:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/2637/
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 1
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Mon, 08 Jun 2026 09:46:37 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 1: Verified+1
Build Successful
http://jenkins.kudu.apache.org/job/pre_commit/2637/ : SUCCESS
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 1
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Mon, 08 Jun 2026 09:58:42 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 2:
Build Started http://jenkins.kudu.apache.org/job/pre_commit/2662/
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 2
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Mon, 15 Jun 2026 08:05:24 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 1:
(4 comments)
Overall this makes sense at first glance.
As for updates/revving this patch, do you plan to address/update this incorporating the review feedback, or you'd rather want somebody from Kudu commiters/PMC took ownership from this point on?
Thanks a lot!
http://gerrit.cloudera.org:8080/#/c/24413/1/THREAT_MODEL.md
File THREAT_MODEL.md:
http://gerrit.cloudera.org:8080/#/c/24413/1/THREAT_MODEL.md@42
PS1, Line 42: an HTTP
: **Web UI** exposes status/metrics.
As of 2026-06-05, there is also REST-style API that's served by the embedded webserver of a Kudu master and provides a means to perform DDL operations on Kudu tables.
http://gerrit.cloudera.org:8080/#/c/24413/1/THREAT_MODEL.md@77
PS1, Line 77:
ditto: there is also REST API served by master's embedded web server, enabled by the --enable_rest_api flag.
http://gerrit.cloudera.org:8080/#/c/24413/1/THREAT_MODEL.md@176
PS1, Line 176: Unauthenticated network client
Does this implicitly include various DoS/DDoS scenarios or those are out of scope for v0 security threat models?
http://gerrit.cloudera.org:8080/#/c/24413/1/THREAT_MODEL.md@277
PS1, Line 277: - Assuming on-disk data is encrypted without `--encrypt_data_at_rest`.
If it makes sense, I'd think of adding one more item: assuming loopback RPC connections are encrypted with --rpc_encryption=required. This corresponds to an item mentioned in paragraph 9.
Even with --rpc_connection=required, loopback RPC connections aren't protected with TLS by default. To enable encryption for loopback RPC connections, add the --rpc_encrypt_loopback_connections flag.
https://kudu.apache.org/docs/configuration_reference.html#kudu-master_rpc_encrypt_loopback_connections
https://kudu.apache.org/docs/configuration_reference.html#kudu-tserver_rpc_encrypt_loopback_connections
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 1
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Comment-Date: Mon, 08 Jun 2026 21:23:58 +0000
Gerrit-HasComments: Yes
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Anonymous Coward (Code Review)" <ge...@cloudera.org>.
jarek@potiuk.com has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 2:
Thanks Alexey and Marton for the review. Patch set 2 addresses the feedback.
On ownership: the ASF Security team keeps this change through pre-flight; the Kudu PMC owns the model once it merges.
Responses to the four comments:
- Lines 42 / 77 (REST API): added. The master embedded-webserver REST API (--enable_rest_api, off by default, can perform DDL on tables) is now listed as a surface in the section 1 narrative, the component-family table, the section 5a knobs table, and the section 6 per-surface table, behind the same authn/authz gate as RPC DDL.
- Line 176 (DoS/DDoS): scoped out for this v0 model -- availability is not a property section 8 commits to. Now stated explicitly in section 3 and section 7; pre-authentication resource exhaustion remains an open item in section 8.8.
- Line 277 (loopback RPC): added. Section 11 now flags assuming loopback (same-host) RPC is encrypted under --rpc_encryption=required (it is not by default; encrypting loopback needs --rpc_encrypt_loopback_connections), and section 10 notes the flag for operators. Section 9 already disclaimed loopback plaintext.
Please take another look when you have a moment.
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 2
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Mon, 15 Jun 2026 08:06:29 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Anonymous Coward (Code Review)" <ge...@cloudera.org>.
Hello Marton Greber, Alexey Serbin, Kudu Jenkins,
I'd like you to reexamine a change. Please visit
http://gerrit.cloudera.org:8080/24413
to look at the new patch set (#2).
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
Adds a v0 security threat model (THREAT_MODEL.md), a SECURITY.md disclosure
pointer to it, and an AGENTS.md entry point so the AGENTS.md -> SECURITY.md ->
THREAT_MODEL.md discoverability chain resolves for automated tooling. The
threat model is a provenance-tagged v0 draft for the PMC to review (see the
open questions in its section 14).
Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Generated-by: Claude Code (Claude Opus 4.8)
---
A AGENTS.md
A SECURITY.md
A THREAT_MODEL.md
3 files changed, 443 insertions(+), 0 deletions(-)
git pull ssh://gerrit.cloudera.org:29418/kudu refs/changes/13/24413/2
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: newpatchset
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 2
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
Adds a v0 security threat model (THREAT_MODEL.md), a SECURITY.md disclosure
pointer to it, and an AGENTS.md entry point so the AGENTS.md -> SECURITY.md ->
THREAT_MODEL.md discoverability chain resolves for automated tooling. The
threat model is a provenance-tagged v0 draft for the PMC to review (see the
open questions in its section 14).
Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Generated-by: Claude Code (Claude Opus 4.8)
Reviewed-on: http://gerrit.cloudera.org:8080/24413
Tested-by: Kudu Jenkins
Reviewed-by: Marton Greber <gr...@gmail.com>
Reviewed-by: Alexey Serbin <al...@apache.org>
---
A AGENTS.md
A SECURITY.md
A THREAT_MODEL.md
3 files changed, 443 insertions(+), 0 deletions(-)
Approvals:
Kudu Jenkins: Verified
Marton Greber: Looks good to me, approved
Alexey Serbin: Looks good to me, approved
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: merged
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 3
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 2: Code-Review+2
Looks good from my end, I would say let Alexey also have a final look and we should be good.
Thank you very much for working on this!
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 2
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Mon, 15 Jun 2026 10:06:38 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Alexey Serbin (Code Review)" <ge...@cloudera.org>.
Alexey Serbin has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 2: Code-Review+2
LGTM.
Thank you very much for working on this!
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 2
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Tue, 16 Jun 2026 05:41:09 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Marton Greber (Code Review)" <ge...@cloudera.org>.
Marton Greber has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 1: Code-Review+1
+1 to Alexeys comments, the rest looks good!
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 1
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Tue, 09 Jun 2026 13:42:50 +0000
Gerrit-HasComments: No
[kudu-CR] Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT MODEL.md
Posted by "Kudu Jenkins (Code Review)" <ge...@cloudera.org>.
Kudu Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/24413 )
Change subject: Add security threat model and wire AGENTS.md -> SECURITY.md -> THREAT_MODEL.md
......................................................................
Patch Set 2: Verified+1
Build Successful
http://jenkins.kudu.apache.org/job/pre_commit/2662/ : SUCCESS
--
To view, visit http://gerrit.cloudera.org:8080/24413
To unsubscribe, visit http://gerrit.cloudera.org:8080/settings
Gerrit-Project: kudu
Gerrit-Branch: master
Gerrit-MessageType: comment
Gerrit-Change-Id: I41a29e63e09430abc8812ca4edc2e8665d19ab6b
Gerrit-Change-Number: 24413
Gerrit-PatchSet: 2
Gerrit-Owner: Anonymous Coward <ja...@potiuk.com>
Gerrit-Reviewer: Alexey Serbin <al...@apache.org>
Gerrit-Reviewer: Kudu Jenkins (120)
Gerrit-Reviewer: Marton Greber <gr...@gmail.com>
Gerrit-Comment-Date: Mon, 15 Jun 2026 08:05:46 +0000
Gerrit-HasComments: No