From 25df29c87393faaa613b43bec806b0cf3db12d96 Mon Sep 17 00:00:00 2001 From: Nitish Bhat Date: Mon, 6 Jul 2026 20:57:50 -0700 Subject: [PATCH 1/2] security: Mythos AI-scan fixes batch 2 (KUBE-34, KUBE-32) (#1571) * security(kmm): remove dead RHEL driver-build template (KUBE-34) The RHEL KMM driver-build template passed the Red Hat subscription password via subscription-manager --password inside a RUN layer, which would expose the credential in the build ConfigMap, process table, image history, and logs (and the ; exit 0 suffix masked registration failures). The path was already disabled: the "rhel" case in resolveDockerfile was commented out, DockerfileTemplate.rhel was not go:embed'd or referenced, and the RedhatSubscription* CRD fields it read no longer exist, so osDistro == "rhel" already falls through to "not supported OS". No live code path could leak the credential. Per team confirmation RHEL support is not being revived, so remove the dead template file and the stale commented-out block rather than hardening an unreachable path. * security(api): document trust model for driver-build repo/GPG URLs (KUBE-32) The KMM driver-build templates fetch the apt/dnf GPG trust root from a URL that can be supplied via DeviceConfig (spec.driver.imageBuild.gpgKeyURL, packageRepoURL, amdgpuInstallerRepoURL). Since that key verifies the amdgpu packages for a ring-0 kernel module on every node, controlling it is high impact. This is by design, not a defect: these are optional fields added for custom-mirror / air-gapped installs (#540), and the only actor who can set them is someone with write access to DeviceConfig, who already controls the driver's package source. The scan's recommended fix (reject a CR-supplied key URL) would break the air-gapped feature. Rather than change behavior, document the trust model on the three URL fields: they are trusted, privileged build inputs; DeviceConfig write access should be treated as control over the driver's package source / trust root and granted only to trusted admins; prefer https URLs you control. Regenerated the CRD, helm CRD, and CSV descriptors to match. * docs(plan): add plan file for Mythos security batch 2 Satisfies the pr-plan-check gate for pensando #1571. (cherry picked from commit 6c707db4fd8febc42f8f651d0f1c5e02826c0abd) --- ...md-gpu-operator.clusterserviceversion.yaml | 2 +- .../2026-07-01-mythos-security-batch-2.md | 66 +++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-) create mode 100644 docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md diff --git a/bundle/manifests/amd-gpu-operator.clusterserviceversion.yaml b/bundle/manifests/amd-gpu-operator.clusterserviceversion.yaml index 5b473bb5b..a44a281c0 100644 --- a/bundle/manifests/amd-gpu-operator.clusterserviceversion.yaml +++ b/bundle/manifests/amd-gpu-operator.clusterserviceversion.yaml @@ -36,7 +36,7 @@ metadata: capabilities: Seamless Upgrades categories: AI/Machine Learning,Monitoring containerImage: registry.test.pensando.io:5000/amd-gpu-operator:dev - createdAt: "2026-07-06T09:55:35Z" + createdAt: "2026-07-06T21:02:18Z" description: |- Operator responsible for deploying AMD GPU kernel drivers, device plugin, device test runner and device metrics exporter For more information, visit [documentation](https://instinct.docs.amd.com/projects/gpu-operator/en/latest/) diff --git a/docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md b/docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md new file mode 100644 index 000000000..1ddba9d88 --- /dev/null +++ b/docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md @@ -0,0 +1,66 @@ +# Mythos AI-scan security fixes — batch 2 (KUBE-34, KUBE-32) + +- **Date:** 2026-07-01 +- **Author:** Nitish Bhat +- **Related PR(s):** pensando #1571 (ROCm counterpart: ROCm/gpu-operator #589) +- **Related issue(s) / JIRA:** KUBE-34, KUBE-32 + +## Context + +Second batch of Mythos AI security-scan fixes for the GPU operator. +Both findings apply to the pensando fork. + +## Approach + +- **KUBE-34** — the RHEL KMM driver-build template passed the Red Hat + subscription password via `subscription-manager --password` inside a + `RUN` layer (would land in the build ConfigMap, process table, image + history, and logs; `; exit 0` masked failures). The path was already + dead: the `"rhel"` case in `resolveDockerfile` was commented out, + `DockerfileTemplate.rhel` was not embedded or referenced, and the + `RedhatSubscription*` CRD fields it read no longer exist, so + `osDistro == "rhel"` already fell through to "not supported OS". + Per team confirmation RHEL support is not being revived, so the dead + template and commented block are removed. +- **KUBE-32** — the KMM driver-build templates fetch the apt/dnf GPG + trust root from a URL that can be supplied via `DeviceConfig` + (`gpgKeyURL`/`packageRepoURL`/`amdgpuInstallerRepoURL`). This is by + design (optional fields for custom-mirror / air-gapped installs), and + the only actor who can set them already controls the driver's package + source via DeviceConfig write access. The scan's suggested fix (reject + a CR-supplied key URL) would break air-gapped support. Instead, the + trust model is documented on the three fields, and the CRD / helm CRD / + CSV descriptors are regenerated to match. + +### Alternatives considered + +- KUBE-34: harden the RHEL template in place (BuildKit secret mount + + activation keys) — rejected; the path is disabled and does not compile, + so this would be speculative, untestable code. +- KUBE-32: remove `gpgKeyURL` and hardcode the AMD key (the scan's + recommendation) — rejected; it would break the air-gapped/custom-mirror + feature this field was added for. + +## Scope + +- **In scope:** removal of `DockerfileTemplate.rhel` + the dead RHEL + block in `internal/kmmmodule/kmmmodule.go`; doc-only additions to the + three URL fields in `api/v1alpha1/deviceconfig_types.go` and the + regenerated CRD/helm-CRD/CSV/bundle artifacts. +- **Out of scope:** any behavior change to the driver build; reviving + RHEL support. + +## Validation + +- Unit tests: `go build ./...`, `go vet ./internal/kmmmodule/`, and + `go test ./internal/kmmmodule/` pass. +- Integration / e2e tests: generated artifacts produced by + `make manifests` + `make bundle-build` on this branch; + `operator-sdk bundle validate ./bundle` passes. +- Manual / hardware steps: none. + +## Risks and rollback + +- Known risks: very low — KUBE-34 removes unreachable code; KUBE-32 is + documentation-only on live fields with no behavior change. +- Rollback plan: revert the two commits on this branch. From 6da65f84f6c89a6bfeac47e9623d3cccf00acc6d Mon Sep 17 00:00:00 2001 From: Praveen Kumar Shanmugam <58961022+spraveenio@users.noreply.github.com> Date: Tue, 7 Jul 2026 07:24:10 -0700 Subject: [PATCH 2/2] Delete docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md --- .../2026-07-01-mythos-security-batch-2.md | 66 ------------------- 1 file changed, 66 deletions(-) delete mode 100644 docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md diff --git a/docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md b/docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md deleted file mode 100644 index 1ddba9d88..000000000 --- a/docs-internal/knowledge/plans/2026-07-01-mythos-security-batch-2.md +++ /dev/null @@ -1,66 +0,0 @@ -# Mythos AI-scan security fixes — batch 2 (KUBE-34, KUBE-32) - -- **Date:** 2026-07-01 -- **Author:** Nitish Bhat -- **Related PR(s):** pensando #1571 (ROCm counterpart: ROCm/gpu-operator #589) -- **Related issue(s) / JIRA:** KUBE-34, KUBE-32 - -## Context - -Second batch of Mythos AI security-scan fixes for the GPU operator. -Both findings apply to the pensando fork. - -## Approach - -- **KUBE-34** — the RHEL KMM driver-build template passed the Red Hat - subscription password via `subscription-manager --password` inside a - `RUN` layer (would land in the build ConfigMap, process table, image - history, and logs; `; exit 0` masked failures). The path was already - dead: the `"rhel"` case in `resolveDockerfile` was commented out, - `DockerfileTemplate.rhel` was not embedded or referenced, and the - `RedhatSubscription*` CRD fields it read no longer exist, so - `osDistro == "rhel"` already fell through to "not supported OS". - Per team confirmation RHEL support is not being revived, so the dead - template and commented block are removed. -- **KUBE-32** — the KMM driver-build templates fetch the apt/dnf GPG - trust root from a URL that can be supplied via `DeviceConfig` - (`gpgKeyURL`/`packageRepoURL`/`amdgpuInstallerRepoURL`). This is by - design (optional fields for custom-mirror / air-gapped installs), and - the only actor who can set them already controls the driver's package - source via DeviceConfig write access. The scan's suggested fix (reject - a CR-supplied key URL) would break air-gapped support. Instead, the - trust model is documented on the three fields, and the CRD / helm CRD / - CSV descriptors are regenerated to match. - -### Alternatives considered - -- KUBE-34: harden the RHEL template in place (BuildKit secret mount + - activation keys) — rejected; the path is disabled and does not compile, - so this would be speculative, untestable code. -- KUBE-32: remove `gpgKeyURL` and hardcode the AMD key (the scan's - recommendation) — rejected; it would break the air-gapped/custom-mirror - feature this field was added for. - -## Scope - -- **In scope:** removal of `DockerfileTemplate.rhel` + the dead RHEL - block in `internal/kmmmodule/kmmmodule.go`; doc-only additions to the - three URL fields in `api/v1alpha1/deviceconfig_types.go` and the - regenerated CRD/helm-CRD/CSV/bundle artifacts. -- **Out of scope:** any behavior change to the driver build; reviving - RHEL support. - -## Validation - -- Unit tests: `go build ./...`, `go vet ./internal/kmmmodule/`, and - `go test ./internal/kmmmodule/` pass. -- Integration / e2e tests: generated artifacts produced by - `make manifests` + `make bundle-build` on this branch; - `operator-sdk bundle validate ./bundle` passes. -- Manual / hardware steps: none. - -## Risks and rollback - -- Known risks: very low — KUBE-34 removes unreachable code; KUBE-32 is - documentation-only on live fields with no behavior change. -- Rollback plan: revert the two commits on this branch.