fix: harden validation container volume mounts and support private sigstore instances - #190
Open
sampras343 wants to merge 4 commits into
Open
sampras343 wants to merge 4 commits into
sampras343 wants to merge 4 commits into
Conversation
The webhook copies all volume mounts from application containers into the injected validation container. These were inherited with their original read/write permissions, violating least-privilege — the validation agent only reads model files and signatures. Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
Instead of copying all volume mounts from all app containers into the validation container, only mount volumes whose mountPath is a prefix of a path the agent actually needs (model path, signature path, CA cert, public key). Prevents read access to unrelated secrets, tokens, and TLS keys if the validation-agent image is compromised. Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
sampras343
force-pushed
the
fix/readonly-volume-mounts
branch
from
September 23, 2026 09:51
92dd437 to
4702126
Compare
sampras343
changed the title
This was referenced Sep 25, 2026
Open
…iners The security hardening in 9a4ffeb set readOnlyRootFilesystem on injected validation containers, which broke sigstore verification in two ways: 1. The sigstore-go TUF client needs to write to /.sigstore for trust root metadata. Inject an emptyDir volume at /.sigstore when sigstoreConfig is used. 2. collectNeededPaths did not include clientTrustConfig.trustConfigPath, so filterVolumeMounts never copied the trust config volume into the init container. Add it to the needed paths. Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
sampras343
force-pushed
the
fix/readonly-volume-mounts
branch
from
September 25, 2026 10:57
174c486 to
a5ccb0c
Compare
1. Set a 10Mi sizeLimit on the sigstore-tuf-cache emptyDir volume to prevent a compromised agent from filling the node's ephemeral storage. 2. Reject mountPath "/" in filterVolumeMounts and require proper directory prefix matching (trailing slash). A container with mountPath "/" would previously match every neededPath, leaking access to the entire volume into the validation container. Add unit tests for filterVolumeMounts covering prefix matching, root path rejection, partial directory name rejection, exact path matching, deduplication, and multi-path scenarios. Signed-off-by: Sachin Sampras M <sampras343@gmail.com>
sampras343
force-pushed
the
fix/readonly-volume-mounts
branch
from
September 25, 2026 15:06
3eac0da to
a0716bf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Hardens volume mounts on injected validation containers and fixes two bugs discovered when testing with
readOnlyRootFilesystemagainst both public Sigstore and private RHTAS instances.Changes
Volume mount restrictions (commits 1-2)
ReadOnly: trueset, preventing the validation agent from writing to any application volume.mountPathis a prefix of a needed path are included. Needed paths are:model.Path,model.SignaturePath,config.PkiConfig.CertificateAuthority,config.PublicKeyConfig.KeyPath, andconfig.ClientTrustConfig.TrustConfigPath.Bug fixes for readOnlyRootFilesystem (commit 3)
The security hardening in #178 set
readOnlyRootFilesystem: trueon injected validation containers, which broke sigstore verification:/.sigstore. WhensigstoreConfigis used, inject anemptyDirvolume at/.sigstoreto provide a writable cache without compromising the read-only root filesystem.collectNeededPathsdid not includeclientTrustConfig.trustConfigPath, sofilterVolumeMountsnever copied the trust config volume into the init container. This broke verification against private sigstore instances (e.g. RHTAS with Keycloak).Why
The webhook was copying all volume mounts from all application containers into the validation init container verbatim, exposing service account tokens, TLS keys, database credentials, and other secrets. The validation agent only needs to read model files, signatures, and trust configuration.
The TUF cache and trust config path bugs were caught during end-to-end testing with both public Sigstore and a private RHTAS instance on an OpenShift cluster with enforced pod security standards.
Testing
Verified on OpenShift 4.22 with:
clientTrustConfigwith the private instance's trust rootBoth modes: init container completes successfully (exit 0), pod transitions to Running, ModelValidation CR shows correct injection status.
Fixes #191
Fixes #192
Fixes #193