sean/kratos-identity-operator
Watch
1
0
Fork
You've already forked kratos-identity-operator
 0
Code Issues Pull requests Projects Releases 14 Packages Wiki Activity
14 releases 25 tags
  • v0.5.16 d7dc4b6b6b

    v0.5.16 Stable

    pipeline-bot released this 2026-07-23 17:25:43 +00:00 | 5 commits to main since this release

    Security

    • Require every KratosIdentity to use the exact namespace-local Admin API
      endpoint (http://kratos-admin.<namespace>.svc.cluster.local:4434). This
      prevents a CR author from redirecting the controller's Secret-backed password
      submission to an arbitrary or cross-tenant HTTP endpoint.
    • Path-escape Kratos-returned identity IDs before update and delete requests so
      a malformed or compromised response cannot alter the Admin API path.

    Changed

    • Fail safely instead of panicking when the reconciler HTTP client is not
      configured.
    • Clear the repository's lint and gosec backlog (unchecked response closes,
      mock response writes, and stale controller-runtime assertions); both strict
      full-repository gates now report zero issues.

    Included changes (v0.5.15 -> v0.5.16)

    • 6b8737bc5354 fix(controller): constrain Kratos admin requests
    Downloads