Narrow TemporalConnection RBAC: finalizer updates currently require main-resource writes

未关闭
  • 哪里不对？
#321 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

这个 Issue 还没有评估数据。

描述

rbac

Problem

Downstream deployers want to grant the controller minimum RBAC on TemporalConnection.

The chart already declares a /finalizers RBAC rule:

- apiGroups: [temporal.io]
  resources: [temporalconnections/finalizers]
  verbs: [update]

Ideally, this would move finalizer writes out of the main-resource permission path, while keeping writes scoped to /status and /finalizers.

In practice, the current DeprecatedTCReconciler mutates finalizers via main-object Update:

https://github.com/temporalio/temporal-worker-controller/blob/main/internal/controller/deprecated_tc_reconciler.go#L37-L75

Because this is r.Update(ctx, &tc) on the main resource, Kubernetes RBAC checks update on temporalconnections, not only temporalconnections/finalizers. As a result, downstream charts must still grant main-resource update / patch, which broadens the controller's write surface on user-owned TemporalConnection.spec.

The same pattern appears to exist for the modern Connection kind in internal/controller/worker_controller.go (lines 760-774, lines 817-820), where temporal.io/delete-protection is added/removed via main-object Update.

Desired outcome

One of:

  • Switch finalizer mutation in DeprecatedTCReconciler and the equivalent Connection finalizer paths to use the /finalizers subresource explicitly, for example via controller-runtime's finalizers subresource support or an equivalent patch helper.
  • Or document in the chart README / RBAC comments that main-resource update / patch on temporalconnections and connections is required for finalizer management, so downstream RBAC reviews can treat it as an intentional requirement rather than over-broad permission.
  • Or land an interim doc note now and track a later code refactor.

Context

This came up during a Coinbase InfraSec review of a sandbox deployment of the controller. Sandbox deployment can proceed with documented broad RBAC, but production rollout requires a narrower or better-justified TemporalConnection write surface.

Related issues:

  • #311 covers Secret-read RBAC reduction through file-based mTLS.
  • #317 reports another impact of finalizer mutation via main-object Update on TemporalWorkerDeployment field ownership.

This issue tracks the RBAC/security impact for TemporalConnection and Connection.

主要语言
Go
星标
198
派生
84
平均合并
2 天 18 小时
30 天内合并 PR
35

环境准备

  • 提供 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 没有贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

temporalio/temporal-worker-controller 的其他 Issue

查看 temporalio/temporal-worker-controller 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。