fix(registry): the admin credential is not readable from every namespace

sean commented

2026-09-10 09:56:52 +00:00

Owner

zot-registry-registry-credentials is a ClusterSecretStore with no conditions, so any namespace could read the credential the kernel chain pushes and signs with. Recorded as pre-existing debt during the RustFS audit; it is a three-line fix. The list is the three live consumers, verified declared and SecretSynced -- one of them the kernel sign wave, so the guard pins the exact list rather than merely requiring conditions. Four controls confirmed red. https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

sean added 1 commit

2026-09-10 09:56:52 +00:00

fix(registry): the admin credential is not readable from every namespace

binjovi/ci Binjovi completed the frozen plan

Details

b4f3ed08b0

`zot-registry-registry-credentials` is a ClusterSecretStore over namespace
`registry` with **no conditions**, and a ClusterSecretStore without them is
readable by an ExternalSecret in ANY namespace. It hands out the credential
the kernel chain pushes and signs with. On a cluster whose stated purpose is
running arbitrary code as a service, that is the wrong blast radius.

This was found during the RustFS migration audit and written down as
pre-existing debt -- "worth its own change" -- rather than fixed. It is a
three-line change, so it is fixed here.

The list is the live consumers, each declared in sean/seanfarm and each
SecretSynced when this was written:

  openbao-operator-system/registry-pull-secret   openbao-operator-prereqs
  shipwright-build/registry-sean-farm-push       shipwright-kernel-prereqs
  workflows/registry-credentials                 shipwright-kernel-sign

THE THIRD IS THE KERNEL SIGN WAVE, so an over-narrow list breaks the kernel
path instead of failing loudly in review. That is why
tests/zot-credential-store-scope.sh pins the exact list rather than merely
requiring that conditions exist: adding a consumer means editing the manifest
and the guard in the same change. Four controls run and confirmed red -- each
of the two load-bearing namespaces dropped, a wrong namespace substituted, and
the conditions block removed entirely.

Claude-Session: https://claude.ai/code/session_01KZoQin34jeyt6nDGqvJA76

binjovi-bot merged commit b4f3ed08b0 into trunk

2026-09-10 10:02:35 +00:00

Rows
Columns

fix(registry): the admin credential is not readable from every namespace #59