Commits on Sep 3, 2024

1. Disallow fetching secrets from namespaces different from the host's one …

   The BareMetalHost CRD allows the UserData, MetaData, and NetworkData for
   the provisioned host to be specified as links to k8s Secrets. There are
   fields for both the Name and Namespace of the Secret, meaning that the
   baremetal-operator will read a Secret from any namespace. If a Secret
   contains the key "value" (or "userData", "metaData", or "networkData"),
   its corresponding value can be exfiltrated by a user provisioning a Host
   pointing to that Secret, then retrieving that data from the provisioned
   host.
   
   Authored-by: Zane Bitter <zbitter@redhat.com>
   Co-Authored-By: Dmitry Tantsur <dtantsur@protonmail.com>
   
   Signed-off-by: Tuomo Tanskanen <tuomo.tanskanen@est.tech>

   

   tuminoid committed Sep 3, 2024
   Configuration menu

   • View commit details
   • Copy full SHA for c902595
   • Browse repository at this point

   Copy the full SHA

   c902595 View commit details

   Browse the repository at this point in the history