You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "villebro (via GitHub)" <gi...@apache.org> on 2026/08/17 23:44:19 UTC
[PR] fix(controller): gate resource adoption and cleanup on ownership [superset-kubernetes-operator]
villebro opened a new pull request, #277:
URL: https://github.com/apache/superset-kubernetes-operator/pull/277
## Summary
Fixes two related access-control gaps (security-scan findings **f001** and **f002**) that let a user holding only `supersets` create/update turn the operator's namespace-wide RBAC against resources owned by *other* controllers. Both contradict guarantees already documented in `docs/reference/security.md` ("controller-owner semantics prevent adopting resources already controlled by another controller" and the cleanup semantics that permit deleting only unowned same-name or operator-labeled resources), so this brings the code in line with the documented threat model rather than changing it.
## Details
**f001 — web-server Service owner-reference wipe.** `reconcileWebServerService` set `svc.OwnerReferences = nil` inside the CreateOrUpdate mutate function before `controllerutil.SetControllerReference`, defeating the `AlreadyOwnedError` guard (the only site in the package that did this). A CR named to collide with a foreign controller-owned Service `{name}-web-server` would seize it — selector/ports rewritten to the attacker's pods — and garbage-collect it when the CR is deleted. The wipe is now scoped to legacy `superset.apache.org`-group owner refs (the actual upgrade case) via `stripLegacySupersetOwnerRefs`; foreign controller refs are preserved so `SetControllerReference` fails with `AlreadyOwnedError` and surfaces the conflict.
**f002 — name-derived deletes ignore ownership.** Several cleanup paths (`deleteComponentResources`, `drainComponents`, `deleteMaintenanceResources`, `deleteLifecycleJob`, and the empty-config ConfigMap branches) deleted purely by CR-derived name with only `IgnoreNotFound`, so a foreign controller-owned resource at a colliding managed name was deleted on every reconcile — a persistent DoS the victim controller cannot win. A new `deleteIfNotForeignOwned` helper `Get`s the live object, skips it when it is controller-owned by a different owner, and otherwise deletes with a UID precondition (closing the Get/Delete race). All by-name delete sites route through it. Unowned same-name resources are still deleted, matching the documented cleanup contract.
Adds regression tests: foreign-owner preservation + reconcile error, legacy same-group owner adoption, and the ownership-gated delete predicate (unowned/CR-owned deleted, foreign preserved, missing tolerated).
## Testing
- `go build ./...`, `gofmt`, `golangci-lint run` clean
- `go test ./internal/controller/...` passes, including the new `TestDeleteIfNotForeignOwned`, `TestReconcileWebServerService_DoesNotSeizeForeignOwnedService`, and `TestReconcileWebServerService_AdoptsLegacySupersetOwnedService`
Part of a series of security-scan follow-ups; opened as a draft.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(controller): gate resource adoption and cleanup on ownership [superset-kubernetes-operator]
Posted by "villebro (via GitHub)" <gi...@apache.org>.
villebro merged PR #277:
URL: https://github.com/apache/superset-kubernetes-operator/pull/277
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(controller): gate resource adoption and cleanup on ownership [superset-kubernetes-operator]
Posted by "codecov-commenter (via GitHub)" <gi...@apache.org>.
codecov-commenter commented on PR #277:
URL: https://github.com/apache/superset-kubernetes-operator/pull/277#issuecomment-5321591513
## [Codecov](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `84.37500%` with `5 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 90.10%. Comparing base ([`41c95d7`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/41c95d76da37110f6d4fa786e1ad1836ac4d0188?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`1e1bee0`](https://app.codecov.io/gh/apache/superset-kubernetes-operator/commit/1e1bee03a834b3f0cb0c7e306ed6557d9a9685c7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [internal/controller/lifecycle\_job.go](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?src=pr&el=tree&filepath=internal%2Fcontroller%2Flifecycle_job.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-aW50ZXJuYWwvY29udHJvbGxlci9saWZlY3ljbGVfam9iLmdv) | 60.00% | [0 Missing and 2 partials :warning: ](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [internal/controller/maintenance.go](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?src=pr&el=tree&filepath=internal%2Fcontroller%2Fmaintenance.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-aW50ZXJuYWwvY29udHJvbGxlci9tYWludGVuYW5jZS5nbw==) | 0.00% | [0 Missing and 2 partials :warning: ](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [internal/controller/networking.go](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?src=pr&el=tree&filepath=internal%2Fcontroller%2Fnetworking.go&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-aW50ZXJuYWwvY29udHJvbGxlci9uZXR3b3JraW5nLmdv) | 90.00% | [0 Missing and 1 partial :warning: ](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset-kubernetes-operator/pull/277?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org