Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Narrow TemporalConnection RBAC: finalizer updates currently require main-resource writes

Abierto
  • ¿Algo no está bien?
#321 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Este issue todavía no se ha evaluado.

Descripción

rbac

Problem

Downstream deployers want to grant the controller minimum RBAC on TemporalConnection.

The chart already declares a /finalizers RBAC rule:

- apiGroups: [temporal.io]
  resources: [temporalconnections/finalizers]
  verbs: [update]

Ideally, this would move finalizer writes out of the main-resource permission path, while keeping writes scoped to /status and /finalizers.

In practice, the current DeprecatedTCReconciler mutates finalizers via main-object Update:

https://github.com/temporalio/temporal-worker-controller/blob/main/internal/controller/deprecated_tc_reconciler.go#L37-L75

Because this is r.Update(ctx, &tc) on the main resource, Kubernetes RBAC checks update on temporalconnections, not only temporalconnections/finalizers. As a result, downstream charts must still grant main-resource update / patch, which broadens the controller's write surface on user-owned TemporalConnection.spec.

The same pattern appears to exist for the modern Connection kind in internal/controller/worker_controller.go (lines 760-774, lines 817-820), where temporal.io/delete-protection is added/removed via main-object Update.

Desired outcome

One of:

  • Switch finalizer mutation in DeprecatedTCReconciler and the equivalent Connection finalizer paths to use the /finalizers subresource explicitly, for example via controller-runtime's finalizers subresource support or an equivalent patch helper.
  • Or document in the chart README / RBAC comments that main-resource update / patch on temporalconnections and connections is required for finalizer management, so downstream RBAC reviews can treat it as an intentional requirement rather than over-broad permission.
  • Or land an interim doc note now and track a later code refactor.

Context

This came up during a Coinbase InfraSec review of a sandbox deployment of the controller. Sandbox deployment can proceed with documented broad RBAC, but production rollout requires a narrower or better-justified TemporalConnection write surface.

Related issues:

  • #311 covers Secret-read RBAC reduction through file-based mTLS.
  • #317 reports another impact of finalizer mutation via main-object Update on TemporalWorkerDeployment field ownership.

This issue tracks the RBAC/security impact for TemporalConnection and Connection.

Lenguaje dominante
Go
Estrellas
197
Forks
79
Merge medio
3 d 13 h
PR fusionados (30 d)
25

Preparar el entorno

  • Incluye un Dockerfile o un archivo de Docker Compose
  • Sin plantilla de pull request
  • Sin guía de contribución

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de temporalio/temporal-worker-controller

Todos los issues de temporalio/temporal-worker-controller

Issues similares

Más issues de Go

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.