3 people ea56ebe648 fix(agent): restrict clientCertificateRefs to same-namespace secrets (#826) ...

AgentEndpoint.spec.clientCertificateRefs used K8sObjectRefOptionalNamespace,
which allowed callers to specify an arbitrary namespace. The controller honored
this field and read the referenced Secret from whatever namespace was given,
using the operator's service account — which holds a ClusterRole with
secrets:[get,list,watch] cluster-wide in the default install.

This was a confused deputy vulnerability: any user who could create or update
an AgentEndpoint could direct the operator to read secrets from namespaces they
themselves cannot access.

Fix by changing clientCertificateRefs to K8sObjectRef (name-only). The
controller now unconditionally reads certificate secrets from the AgentEndpoint's
own namespace. The namespace field is also removed from the CRD schema so
Kubernetes prunes it at admission time if supplied.

Signed-off-by: Jonathan Stacks <jonstacks@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-08 17:53:36 +00:00

..

bindings/v1alpha1

chore(dependencies): Update dependencies (#822)

2026-06-05 14:40:06 +00:00

common/v1alpha1

update use endpoints annotation (#579)

2025-01-22 20:15:27 +00:00

ingress/v1alpha1

chore(dependencies): Update dependencies (#822)

2026-06-05 14:40:06 +00:00

ngrok/v1alpha1

fix(agent): restrict clientCertificateRefs to same-namespace secrets (#826)

2026-06-08 17:53:36 +00:00