feat(helm)!: confine gateway workspace permissions with an admission policy

[krishicks]

Summary

tl;dr: The Helm chart installs a ValidatingAdmissionPolicy, on by default in managed and operator modes, that limits the gateway's cluster-scoped workspace permissions to namespaces it owns or selects.

The policy matches only the gateway ServiceAccount. It admits Secret, Pod, Sandbox, Service, ServiceAccount, and NetworkPolicy writes only in namespaces labeled as owned by this gateway, and namespaces matching the operator selector. Secret writes are also admitted in the credential namespace when the Kubernetes Secrets credential driver is enabled. Namespace writes are admitted only for namespaces owned by this gateway, judged by their existing labels.

Related Issue

No public issue; maintainers have context.

Changes

• Add the admissionPolicy.enabled value (default true) and render a ValidatingAdmissionPolicy and binding in managed and operator modes.
• Skip rendering the policy when rbac.create=false or rbac.clusterScoped.create=false; a cluster-admin applies it with the other cluster-scoped objects.
• Require Kubernetes 1.30.
• Fail rendering with operatorNamespaceFile or set-based operator selectors, which the policy cannot evaluate. admissionPolicy.enabled=false opts out.
• Add e2e checks in managed and operator modes that send server-side dry-run requests as the gateway ServiceAccount outside its namespaces, including Pod creation in the sandbox and credential namespace, and assert the policy rejects them.
• Document the policy and opt-out, raise the minimum Kubernetes version in the docs and support matrix, and add policy denials to the cluster debugging skill.

Breaking: Kubernetes 1.30 or later is required, installers that create cluster-scoped RBAC need permission to create ValidatingAdmissionPolicies and bindings, and operatorNamespaceFile or set-based operatorNamespaceLabel require admissionPolicy.enabled=false.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Ran the managed and operator Kubernetes e2e suites locally on k3d with the policy enabled.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-3630.docs.buildwithfern.com/openshell

[github-actions]

Label test:e2e applied for 81410a6. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.

[drew]

gator-agent

PR Review Status

PR #3630 is project-valid maintainer-authored Kubernetes hardening in the stack rooted at #3616. The initial review found one blocking namespace-confinement gap.

Action required: scope the sandbox and credential namespace exceptions to only the resource operations actually required there, and add denial coverage for Pod creation.

Blocking findings:

• GATOR-0096cf3e-01: special namespaces bypass confinement for every covered resource

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Maintainer-authored security hardening, reviewed as the #3630-only patch atop #3629 with #3616 stack ancestry confirmed
• Docs: Fern docs and related architecture/support guidance updated
• Checks: Current-head required checks are still running
• E2E: test:e2e applied; current-head E2E workflow is running
• Head SHA: 0096cf3ef32ed59e183e888ace5d2f897ceef241
• Base SHA: dc612a9801d564dfd3a716ea720a1f4b882dd530
• Merge base SHA: dc612a9801d564dfd3a716ea720a1f4b882dd530
• Patch ID: f6a865b6401d709ec37c06f731d718cce3cb6dc5
• Gator payload: 10
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[elezar]

The earlier admission-policy handoff concern is addressed in 7d843b3: disabling RBAC creation no longer suppresses the policy, and the migration instructions now cover both admission objects. All 230 Helm unit tests passed locally, and I verified that the policy still renders with either RBAC creation flag disabled.

Please update the PR description to match the implementation. It still says that rbac.create=false or rbac.clusterScoped.create=false skips rendering the policy. Namespace-admin installs now need to explicitly set admissionPolicy.enabled=false after the cluster-admin applies the policy and binding separately.