Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Narrow TemporalConnection RBAC: finalizer updates currently require main-resource writes

Aperta
  • Qualcosa non va?
#321 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

rbac

Problem

Downstream deployers want to grant the controller minimum RBAC on TemporalConnection.

The chart already declares a /finalizers RBAC rule:

- apiGroups: [temporal.io]
  resources: [temporalconnections/finalizers]
  verbs: [update]

Ideally, this would move finalizer writes out of the main-resource permission path, while keeping writes scoped to /status and /finalizers.

In practice, the current DeprecatedTCReconciler mutates finalizers via main-object Update:

https://github.com/temporalio/temporal-worker-controller/blob/main/internal/controller/deprecated_tc_reconciler.go#L37-L75

Because this is r.Update(ctx, &tc) on the main resource, Kubernetes RBAC checks update on temporalconnections, not only temporalconnections/finalizers. As a result, downstream charts must still grant main-resource update / patch, which broadens the controller's write surface on user-owned TemporalConnection.spec.

The same pattern appears to exist for the modern Connection kind in internal/controller/worker_controller.go (lines 760-774, lines 817-820), where temporal.io/delete-protection is added/removed via main-object Update.

Desired outcome

One of:

  • Switch finalizer mutation in DeprecatedTCReconciler and the equivalent Connection finalizer paths to use the /finalizers subresource explicitly, for example via controller-runtime's finalizers subresource support or an equivalent patch helper.
  • Or document in the chart README / RBAC comments that main-resource update / patch on temporalconnections and connections is required for finalizer management, so downstream RBAC reviews can treat it as an intentional requirement rather than over-broad permission.
  • Or land an interim doc note now and track a later code refactor.

Context

This came up during a Coinbase InfraSec review of a sandbox deployment of the controller. Sandbox deployment can proceed with documented broad RBAC, but production rollout requires a narrower or better-justified TemporalConnection write surface.

Related issues:

  • #311 covers Secret-read RBAC reduction through file-based mTLS.
  • #317 reports another impact of finalizer mutation via main-object Update on TemporalWorkerDeployment field ownership.

This issue tracks the RBAC/security impact for TemporalConnection and Connection.

Lingua principale
Go
Stelle
197
Fork
79
Merge medio
4g 3h
PR unite (30g)
24

Preparare l'ambiente

  • Include un Dockerfile o un file Docker Compose
  • Nessun modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di temporalio/temporal-worker-controller

Tutte le issue di temporalio/temporal-worker-controller

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.