sidecar authn follow-ups (deferred from #165)
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 35/100
- Tipo de issue
- Nueva funcionalidad
- Claridad
- Bastante claro
- Estado de actividad
- Tranquilo
- Stack tecnológico
- go, kubernetes
- Área
- authentication, backend, infrastructure, security
Línea de trabajo
Start with the trustedHeaderMiddleware and context helpers in sidecar/server, then read serve.go, gov_vote.go, gov_software_upgrade.go, and auth.go. Separate the actionable startup and audit follow-ups from the deferred TaskResult work and the explicitly out-of-scope mTLS item. Done means the selected checks, logging, and context propagation are implemented with corresponding tests or verified behavior, including refusal to start for the stated hostNetwork condition.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
Tracking items surfaced during the Coral cross-review of PR (TBD — sidecar trusted-header authn).
1. Plumb X-Remote-User through ctx for audit logging
The trustedHeaderMiddleware currently checks presence/uniqueness of X-Remote-User but drops the value on the floor. For audit ("who voted yes on prop 42?") this is the only identity signal available.
Action: add `WithRemoteUser(ctx, value)` and `RemoteUserFromContext(ctx) string` helpers in `sidecar/server`. Have the middleware stamp the value into ctx. Sign-tx handlers (gov_vote.go, gov_software_upgrade.go) include the value in their structured log lines alongside taskId.
Also plumb into TaskResult if/when the engine grows a structured output field (deferred per #174).
2. Startup WARN on unauthenticated mode
When `SEI_SIDECAR_AUTHN_MODE` is unset (backward-compat default), the sidecar accepts unauthenticated requests on all interfaces. Operators upgrading to a binary with #165 support but forgetting to set the env var stay open silently.
Action: at startup in serve.go, log a one-line WARN when AuthnMode==unauthenticated: "sidecar accepting unauthenticated requests on all interfaces — set SEI_SIDECAR_AUTHN_MODE=trusted-header for production." Cheap; provides telemetry on who hasn't migrated.
3. Refuse-to-start on hostNetwork: true
Loopback bind in trusted-header mode collapses if the pod uses `hostNetwork: true` — 127.0.0.1 is shared with the host and every other hostNetwork pod on the node. Currently documented in auth.go but not enforced.
Action: at startup, heuristically detect hostNetwork (compare pod IP from `/etc/hostname` resolution to node IP from downwardAPI). If trusted-header mode AND hostNetwork detected, refuse to start with a clear error. Realistic ask: the controller-side PR in sei-k8s-controller is the load-bearing place to forbid hostNetwork on these pods; this sidecar-side check is belt-and-suspenders.
4. mTLS or shared-secret between proxy and sidecar
Today an attacker who lands code execution in any container in the pod (e.g., the seid container) can `curl 127.0.0.1:7777` directly bypassing the proxy and forge X-Remote-User. The trust boundary is the pod, not the loopback interface.
Action: when/if we move to multi-tenant per-namespace sidecar deployments, consider client certs from proxy to sidecar (proxy presents a cert that the sidecar verifies; sidecar refuses connections without it). Out of scope for current single-tenant validator pods.
References
- PR for #165 (sidecar trusted-header authn)
- Parent: #165 (sidecar authn + authz middleware)
- Cross-review session 2026-05-12
- Lenguaje dominante
- Go
- Estrellas
- 1
- Forks
- 3
- Merge medio
- 14 min
- PR fusionados (30 d)
- 5
Preparar el entorno
- Incluye un Dockerfile o un archivo de Docker Compose
- Sin plantilla de pull request
- Sin guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de sei-protocol/seictl
-
bug
Dificultad 4/5 3-5 días Aptitud para principiantes 48/100
sei-protocol/seictl#236 · 1 comentario ·
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 35/100
sei-protocol/seictl#212 ·
-
Dificultad 4/5 3-5 días Aptitud para principiantes 35/100
sei-protocol/seictl#176 ·
-
Dificultad 5/5 Más de una semana Aptitud para principiantes 30/100
sei-protocol/seictl#174 ·
-
Dificultad 4/5 3-5 días Aptitud para principiantes 52/100
sei-protocol/seictl#171 ·
Todos los issues de sei-protocol/seictl
Issues similares
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
Los mantenedores suelen responder en 1 día
-
orchestration.migration.data.tasks.retry values are ignored by the 8.8 data migration jobPosiblemente ocupada @irisfield la tomó hoy. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
camunda/camunda-platform-helm#7773 ·
Los mantenedores suelen responder en 1 día
-
Add missing unit tests for IsAdmissionPolicyName and IsCertManagerResourceNamePosiblemente ocupada @a1h8 la tomó hoy. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 82/100
kubernetes-sigs/security-profiles-operator#3644 ·
Los mantenedores suelen responder en 1 día
-
[Bug]: Anthropic Responses converter forwards empty text blocks, upstream rejects with 400Posiblemente ocupada @david-choi-querypie la tomó hoy. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
Los mantenedores suelen responder en 1 día
-
[DOCS]: enforce_admins description understates what it covers and omits push restrictionsPosiblemente ocupada @dav-tb la tomó hoy. Abierto
Dificultad 1/5 Menos de una hora Aptitud para principiantes 78/100
integrations/terraform-provider-github#3707 · 1 comentario ·
Los mantenedores suelen responder en 1 día