security: broad Kubernetes and Keycloak authority lacks network containment

[dcmcand]

Summary

The operator holds broad cluster authority and a Keycloak realm-administrator credential, but the shipped configuration provides no network containment: it talks to Keycloak over plaintext HTTP and applies no default-deny egress. The pod is well hardened locally, so this finding is about blast radius, not a specific code defect.

Affected code

• config/rbac/role.yaml - cluster-wide: secrets create/get/list/patch/update/watch (L23-33), roles+rolebindings full management (L80-92), httproutes full management (L68-79), securitypolicies full management (L46-57), certificates full management (L34-45), and gateways get/list/patch/update/watch (L58-67).
• config/manager/manager.yaml - KEYCLOAK_URL is http://...keycloak.../auth (L74-75), and the manager loads the realm-admin credential from nebari-realm-admin-credentials (L74-81). The in-code default is also HTTP (internal/config/auth.go L95; loader at L114-159).
• config/network-policy/allow-metrics-traffic.yaml - the only NetworkPolicy is Ingress-only for metrics (L17-27), and it is commented out in config/default/kustomization.yaml (L34), so the default overlay applies no NetworkPolicy at all. The generated Helm chart carries the same HTTP Keycloak URL and no NetworkPolicy.

Positive controls to retain: the container runs as non-root UID 65532 with RuntimeDefault seccomp, read-only root filesystem, allowPrivilegeEscalation: false, and all capabilities dropped (manager.yaml L57-60, L92-96).

Impact

A compromise of the operator process or a vulnerable dependency has cluster-wide reach: Secret disclosure, RBAC delegation, routing/TLS manipulation, and Keycloak realm administration. Admin credentials travel to Keycloak over cleartext HTTP where the network permits observation.

Remediation

• Require HTTPS with certificate verification or mTLS to Keycloak.
• Apply default-deny egress and allow only the Kubernetes API, Keycloak, DNS, and required endpoints; ship a NetworkPolicy that is enabled by default in both kustomize and Helm.
• Narrow Secret access to named namespaces/objects and reconsider general Role/RoleBinding write authority; split responsibilities across ServiceAccounts where practical.
• Rotate and narrowly scope the Keycloak service identity, and add audit alerts for Secret reads, RBAC writes, Gateway patches, and realm-administration operations.

Acceptance criteria

• The operator communicates with Keycloak over authenticated encryption.
• A default-deny egress policy ships enabled in both kustomize and Helm.

References

• CWE-250 (Execution with Unnecessary Privileges)

Line numbers reference commit 4ad2c10.