Epic: Security assessment remediation (v0.1.0-alpha.20)

[dcmcand]

Goal

Track remediation of the security findings identified in a static assessment of v0.1.0-alpha.20 (pinned commit 4ad2c10). Each finding was independently re-validated against the current code before filing, and each is filed as its own narrowly scoped issue. This is a tracking issue: it groups and orders the work but does not replace the linked issues. The definition of done for each item lives in its linked issue.

This release is a development pre-release, so these are remediation and hardening items for the v0.1.0 security baseline rather than reports against a supported release. See #132 (pre-v0.1.0 release validation) and #129 (graduate from alpha) for the surrounding release work.

All linked issues carry the area: security label.

Findings

Critical

• security: auth-enabled routes are published before SecurityPolicy is accepted (fail-open) #152 - auth-enabled routes are published before the SecurityPolicy is accepted (fail-open)

High

• security: auth.groups is documented as access control but is not enforced at the gateway #153 - auth.groups is documented as access control but is not enforced at the gateway
• security: self-service NebariApp fields can create and administer Keycloak realm groups and memberships #154 - self-service fields can create and administer Keycloak realm groups and memberships
• security: caller-selected spaClient.clientId can reconfigure or delete an existing Keycloak client #155 - caller-selected spaClient.clientId can reconfigure or delete an existing Keycloak client
• security: hostname and TLS listener delegation lacks an ownership boundary #156 - hostname and TLS listener delegation lacks an ownership boundary
• security: release artifacts use mutable inputs and lack signing, provenance, and SBOM #157 - release artifacts use mutable inputs and lack signing, provenance, and SBOM

Medium

• security: generated child resources can overwrite unrelated same-name objects #158 - generated child resources can overwrite unrelated same-name objects
• NebariApp: publicRoutes + default enforceAtGateway produces two competing HTTPRoutes for the same path #118 - protected and public HTTPRoutes can overlap for the same path (existing issue)
• security: Restrict Keycloak OIDC client WebOrigins from wildcard to specific hostnames #37 - Keycloak clients use wildcard WebOrigins (existing issue; also covers HTTP redirect URIs)
• security: generic-oidc issuerURL is unvalidated (gateway-side SSRF and client-secret exposure) #159 - generic-oidc issuerURL is unvalidated (gateway-side SSRF and client-secret exposure)
• security: cross-namespace Service backends lack target-owner consent and leak an existence oracle #160 - cross-namespace Service backends lack target-owner consent and leak an existence oracle
• security: token exchange trusts every peer NebariApp client in the realm #161 - token exchange trusts every peer NebariApp client in the realm
• security: broad Kubernetes and Keycloak authority lacks network containment #162 - broad Kubernetes and Keycloak authority lacks network containment
• security: build uses a stale Go patch and lacks govulncheck, image-scan, and SBOM gates #163 - build uses a stale Go patch and lacks govulncheck, image-scan, and SBOM gates
• security: identity and credential reconciliation is additive with incomplete cleanup #164 - identity and credential reconciliation is additive with incomplete cleanup

Low

• security: user-provided TLS Secrets are not cryptographically or semantically validated #165 - user-provided TLS Secrets are not cryptographically or semantically validated

Notes

• NebariApp: publicRoutes + default enforceAtGateway produces two competing HTTPRoutes for the same path #118 and security: Restrict Keycloak OIDC client WebOrigins from wildcard to specific hostnames #37 predate this pass and already tracked two of the findings; they are linked here rather than duplicated. security: Restrict Keycloak OIDC client WebOrigins from wildcard to specific hostnames #37 remains a sub-issue of Epic: Nebari Operator - Keycloak & Auth #79 (Keycloak & Auth) since an issue can have only one parent, so it appears in the checklist above but not in this epic's sub-issue list.
• Line numbers cited in the linked issues reference commit 4ad2c10. The only intervening change to security-relevant files since then was landing-page icon fields, so the cited behavior is current.