HoustonPutman commented on code in PR #841: URL: https://github.com/apache/solr-operator/pull/841#discussion_r3589939146
########## THREAT_MODEL.md: ########## @@ -0,0 +1,552 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +# Apache Solr Operator — Threat Model (v0 DRAFT) + +## §1 Header + +- **Project:** Apache Solr Operator (`apache/solr-operator`) — the official + Kubernetes operator for Apache Solr. A kubebuilder/controller-runtime Go + controller that watches `solr.apache.org/v1beta1` custom resources + (`SolrCloud`, `SolrBackup`, `SolrPrometheusExporter`) and reconciles the + Kubernetes objects (StatefulSets, Services, ConfigMaps, Secrets, Ingresses, + PodDisruptionBudgets, ZookeeperClusters, PVCs) that make up a running Solr + deployment. It is **not** the Solr search server — the search server is + modelled separately in `apache/solr`'s `THREAT_MODEL.md`, cross-referenced + throughout. +- **Written against:** `main` @ HEAD (2026-07). +- **Author:** ASF Security team, via the threat-model-producer rubric + (Scovetta rubric), as a starting point for the Solr PMC. +- **Status:** **v0 DRAFT** — produced by the ASF Security team *for the Solr + PMC to review, correct, own, and ratify*. **Not yet reviewed by any + maintainer; not ratified.** Almost every claim below is *(inferred)* and + routed to a §14 open question. Do not treat any statement here as a + maintainer position until the PMC has confirmed it. +- **Version binding:** once ratified, versioned alongside the operator. A + report against operator version *N* is triaged against the model as it stood + at *N*, not at HEAD. +- **Canonical role (proposed):** intended to be the operator's + **scanner-facing** security model — the authoritative basis for triaging an + automated finding as in- or out-of-model. It is deliberately *not* an + operator handbook; the operator's user guide (docs/) and Solr's own + "Securing Solr" guidance remain the human source of truth for deployment. + This role split is a §14 question for the PMC to confirm. +- **Reporting cross-reference:** §8-violating findings via the ASF security + process (report to `[email protected]`, see + <https://solr.apache.org/security.html>); §3/§9 findings closed citing this + document. The Solr Operator has no separate disclosure channel from Solr — + §14 confirms. +- **Provenance legend:** *(documented)* = stated in the repo's code, CRD field + docs, or the operator user guide (cited); *(maintainer)* = confirmed by a + Solr PMC member in response to this draft (**none yet**); *(inferred)* = + reasoned from code/CRD/RBAC structure, not yet confirmed — each has a + matching §14 open question. +- **Draft confidence:** ~14 documented / 0 maintainer / 27 inferred. This is a + v0: the *(documented)* claims are lifted from CRD field comments, the RBAC + manifests, and the user guide; everything about *intent, contract, and + scope* is still hypothesis awaiting the PMC. + +**What it is.** The Solr Operator is a **cluster-scoped Kubernetes +controller**. An operator/admin installs it once (typically Helm), granting it +a `ClusterRole`; from then on any user who can create a `SolrCloud` (or +`SolrBackup` / `SolrPrometheusExporter`) custom resource in a watched +namespace causes the operator — acting with its own cluster-wide privileges — +to create and manage the backing Kubernetes objects and to make authenticated +HTTP calls into the Solr pods it manages. The defining security fact is that +the operator is a **privileged intermediary**: it turns a namespaced, +relatively low-privilege action (creating a CR) into high-privilege cluster +mutations (creating Secrets, exec-ing into pods, managing StatefulSets), +across every namespace it watches (all namespaces by default). Review Comment: The Solr Operator can just as easily be installed as a namespace-scoped operator. ########## THREAT_MODEL.md: ########## @@ -0,0 +1,552 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +# Apache Solr Operator — Threat Model (v0 DRAFT) + +## §1 Header + +- **Project:** Apache Solr Operator (`apache/solr-operator`) — the official + Kubernetes operator for Apache Solr. A kubebuilder/controller-runtime Go + controller that watches `solr.apache.org/v1beta1` custom resources + (`SolrCloud`, `SolrBackup`, `SolrPrometheusExporter`) and reconciles the + Kubernetes objects (StatefulSets, Services, ConfigMaps, Secrets, Ingresses, + PodDisruptionBudgets, ZookeeperClusters, PVCs) that make up a running Solr + deployment. It is **not** the Solr search server — the search server is + modelled separately in `apache/solr`'s `THREAT_MODEL.md`, cross-referenced + throughout. +- **Written against:** `main` @ HEAD (2026-07). +- **Author:** ASF Security team, via the threat-model-producer rubric + (Scovetta rubric), as a starting point for the Solr PMC. +- **Status:** **v0 DRAFT** — produced by the ASF Security team *for the Solr + PMC to review, correct, own, and ratify*. **Not yet reviewed by any + maintainer; not ratified.** Almost every claim below is *(inferred)* and + routed to a §14 open question. Do not treat any statement here as a + maintainer position until the PMC has confirmed it. +- **Version binding:** once ratified, versioned alongside the operator. A + report against operator version *N* is triaged against the model as it stood + at *N*, not at HEAD. +- **Canonical role (proposed):** intended to be the operator's + **scanner-facing** security model — the authoritative basis for triaging an + automated finding as in- or out-of-model. It is deliberately *not* an + operator handbook; the operator's user guide (docs/) and Solr's own + "Securing Solr" guidance remain the human source of truth for deployment. + This role split is a §14 question for the PMC to confirm. +- **Reporting cross-reference:** §8-violating findings via the ASF security + process (report to `[email protected]`, see + <https://solr.apache.org/security.html>); §3/§9 findings closed citing this + document. The Solr Operator has no separate disclosure channel from Solr — + §14 confirms. +- **Provenance legend:** *(documented)* = stated in the repo's code, CRD field + docs, or the operator user guide (cited); *(maintainer)* = confirmed by a + Solr PMC member in response to this draft (**none yet**); *(inferred)* = + reasoned from code/CRD/RBAC structure, not yet confirmed — each has a + matching §14 open question. +- **Draft confidence:** ~14 documented / 0 maintainer / 27 inferred. This is a + v0: the *(documented)* claims are lifted from CRD field comments, the RBAC + manifests, and the user guide; everything about *intent, contract, and + scope* is still hypothesis awaiting the PMC. + +**What it is.** The Solr Operator is a **cluster-scoped Kubernetes +controller**. An operator/admin installs it once (typically Helm), granting it +a `ClusterRole`; from then on any user who can create a `SolrCloud` (or +`SolrBackup` / `SolrPrometheusExporter`) custom resource in a watched +namespace causes the operator — acting with its own cluster-wide privileges — +to create and manage the backing Kubernetes objects and to make authenticated +HTTP calls into the Solr pods it manages. The defining security fact is that +the operator is a **privileged intermediary**: it turns a namespaced, +relatively low-privilege action (creating a CR) into high-privilege cluster +mutations (creating Secrets, exec-ing into pods, managing StatefulSets), +across every namespace it watches (all namespaces by default). + +## §2 Scope and intended use + +The Solr Operator is a **long-running in-cluster controller**, not a library +and not a user-facing service. Roles: + +- **CRD author / namespace tenant** — a user (human or CI identity) with RBAC + permission to create/update `SolrCloud`, `SolrBackup`, + `SolrPrometheusExporter` objects in a watched namespace. **Semi-trusted at + most**: they author the *desired state* but do not themselves hold the + operator's cluster privileges. This is the primary adversary of interest + (§7). *(inferred — Q-tenant.)* +- **Cluster operator / admin** — installs the operator, grants its + `ClusterRole`, chooses watched namespaces, controls the Helm values. Review Comment: `ClusterRole` or `Role`. `Role` is used when watching specific namespaces. ########## THREAT_MODEL.md: ########## @@ -0,0 +1,552 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +# Apache Solr Operator — Threat Model (v0 DRAFT) + +## §1 Header + +- **Project:** Apache Solr Operator (`apache/solr-operator`) — the official + Kubernetes operator for Apache Solr. A kubebuilder/controller-runtime Go + controller that watches `solr.apache.org/v1beta1` custom resources + (`SolrCloud`, `SolrBackup`, `SolrPrometheusExporter`) and reconciles the + Kubernetes objects (StatefulSets, Services, ConfigMaps, Secrets, Ingresses, + PodDisruptionBudgets, ZookeeperClusters, PVCs) that make up a running Solr + deployment. It is **not** the Solr search server — the search server is + modelled separately in `apache/solr`'s `THREAT_MODEL.md`, cross-referenced + throughout. +- **Written against:** `main` @ HEAD (2026-07). +- **Author:** ASF Security team, via the threat-model-producer rubric + (Scovetta rubric), as a starting point for the Solr PMC. +- **Status:** **v0 DRAFT** — produced by the ASF Security team *for the Solr + PMC to review, correct, own, and ratify*. **Not yet reviewed by any + maintainer; not ratified.** Almost every claim below is *(inferred)* and + routed to a §14 open question. Do not treat any statement here as a + maintainer position until the PMC has confirmed it. +- **Version binding:** once ratified, versioned alongside the operator. A + report against operator version *N* is triaged against the model as it stood + at *N*, not at HEAD. +- **Canonical role (proposed):** intended to be the operator's + **scanner-facing** security model — the authoritative basis for triaging an + automated finding as in- or out-of-model. It is deliberately *not* an + operator handbook; the operator's user guide (docs/) and Solr's own + "Securing Solr" guidance remain the human source of truth for deployment. + This role split is a §14 question for the PMC to confirm. +- **Reporting cross-reference:** §8-violating findings via the ASF security + process (report to `[email protected]`, see + <https://solr.apache.org/security.html>); §3/§9 findings closed citing this + document. The Solr Operator has no separate disclosure channel from Solr — + §14 confirms. +- **Provenance legend:** *(documented)* = stated in the repo's code, CRD field + docs, or the operator user guide (cited); *(maintainer)* = confirmed by a + Solr PMC member in response to this draft (**none yet**); *(inferred)* = + reasoned from code/CRD/RBAC structure, not yet confirmed — each has a + matching §14 open question. +- **Draft confidence:** ~14 documented / 0 maintainer / 27 inferred. This is a + v0: the *(documented)* claims are lifted from CRD field comments, the RBAC + manifests, and the user guide; everything about *intent, contract, and + scope* is still hypothesis awaiting the PMC. + +**What it is.** The Solr Operator is a **cluster-scoped Kubernetes +controller**. An operator/admin installs it once (typically Helm), granting it +a `ClusterRole`; from then on any user who can create a `SolrCloud` (or +`SolrBackup` / `SolrPrometheusExporter`) custom resource in a watched +namespace causes the operator — acting with its own cluster-wide privileges — +to create and manage the backing Kubernetes objects and to make authenticated +HTTP calls into the Solr pods it manages. The defining security fact is that +the operator is a **privileged intermediary**: it turns a namespaced, +relatively low-privilege action (creating a CR) into high-privilege cluster +mutations (creating Secrets, exec-ing into pods, managing StatefulSets), +across every namespace it watches (all namespaces by default). + +## §2 Scope and intended use + +The Solr Operator is a **long-running in-cluster controller**, not a library +and not a user-facing service. Roles: + +- **CRD author / namespace tenant** — a user (human or CI identity) with RBAC + permission to create/update `SolrCloud`, `SolrBackup`, + `SolrPrometheusExporter` objects in a watched namespace. **Semi-trusted at + most**: they author the *desired state* but do not themselves hold the + operator's cluster privileges. This is the primary adversary of interest + (§7). *(inferred — Q-tenant.)* +- **Cluster operator / admin** — installs the operator, grants its + `ClusterRole`, chooses watched namespaces, controls the Helm values. + **Fully trusted** — owns the operator's blast radius. *(inferred — + Q-admin.)* +- **The managed Solr (search server) and its clients** — out of scope here; + modelled by `apache/solr`'s `THREAT_MODEL.md`. The operator is a *client* of + Solr (it makes authenticated admin API calls), not the thing serving + queries. + +**Component families.** + +| Family | Entry point | Privilege / exposure | In model? | +| --- | --- | --- | --- | +| **CRD field handling** (`api/v1beta1`) | `SolrCloud`/`SolrBackup`/`SolrPrometheusExporter` spec | tenant-authored desired state consumed by a privileged controller | **Yes (primary)** | +| **Reconciliation controllers** (`controllers/`) | watch → reconcile loop | acts with the operator ServiceAccount's cluster RBAC | **Yes (primary)** | +| **Operator cluster RBAC** (`config/rbac/role.yaml`) | the `ClusterRole` bound to the operator SA | secrets/pods-exec/statefulsets cluster-wide | **Yes (blast radius)** | Review Comment: `ClusterRole` or `Role` ########## THREAT_MODEL.md: ########## @@ -0,0 +1,552 @@ +<!-- + Licensed to the Apache Software Foundation (ASF) under one or more + contributor license agreements. See the NOTICE file distributed with + this work for additional information regarding copyright ownership. + The ASF licenses this file to You under the Apache License, Version 2.0 + (the "License"); you may not use this file except in compliance with + the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. +--> +# Apache Solr Operator — Threat Model (v0 DRAFT) + +## §1 Header + +- **Project:** Apache Solr Operator (`apache/solr-operator`) — the official + Kubernetes operator for Apache Solr. A kubebuilder/controller-runtime Go + controller that watches `solr.apache.org/v1beta1` custom resources + (`SolrCloud`, `SolrBackup`, `SolrPrometheusExporter`) and reconciles the + Kubernetes objects (StatefulSets, Services, ConfigMaps, Secrets, Ingresses, + PodDisruptionBudgets, ZookeeperClusters, PVCs) that make up a running Solr + deployment. It is **not** the Solr search server — the search server is + modelled separately in `apache/solr`'s `THREAT_MODEL.md`, cross-referenced + throughout. +- **Written against:** `main` @ HEAD (2026-07). +- **Author:** ASF Security team, via the threat-model-producer rubric + (Scovetta rubric), as a starting point for the Solr PMC. +- **Status:** **v0 DRAFT** — produced by the ASF Security team *for the Solr + PMC to review, correct, own, and ratify*. **Not yet reviewed by any + maintainer; not ratified.** Almost every claim below is *(inferred)* and + routed to a §14 open question. Do not treat any statement here as a + maintainer position until the PMC has confirmed it. +- **Version binding:** once ratified, versioned alongside the operator. A + report against operator version *N* is triaged against the model as it stood + at *N*, not at HEAD. +- **Canonical role (proposed):** intended to be the operator's + **scanner-facing** security model — the authoritative basis for triaging an + automated finding as in- or out-of-model. It is deliberately *not* an + operator handbook; the operator's user guide (docs/) and Solr's own + "Securing Solr" guidance remain the human source of truth for deployment. + This role split is a §14 question for the PMC to confirm. +- **Reporting cross-reference:** §8-violating findings via the ASF security + process (report to `[email protected]`, see + <https://solr.apache.org/security.html>); §3/§9 findings closed citing this + document. The Solr Operator has no separate disclosure channel from Solr — + §14 confirms. +- **Provenance legend:** *(documented)* = stated in the repo's code, CRD field + docs, or the operator user guide (cited); *(maintainer)* = confirmed by a + Solr PMC member in response to this draft (**none yet**); *(inferred)* = + reasoned from code/CRD/RBAC structure, not yet confirmed — each has a + matching §14 open question. +- **Draft confidence:** ~14 documented / 0 maintainer / 27 inferred. This is a + v0: the *(documented)* claims are lifted from CRD field comments, the RBAC + manifests, and the user guide; everything about *intent, contract, and + scope* is still hypothesis awaiting the PMC. + +**What it is.** The Solr Operator is a **cluster-scoped Kubernetes +controller**. An operator/admin installs it once (typically Helm), granting it +a `ClusterRole`; from then on any user who can create a `SolrCloud` (or +`SolrBackup` / `SolrPrometheusExporter`) custom resource in a watched +namespace causes the operator — acting with its own cluster-wide privileges — +to create and manage the backing Kubernetes objects and to make authenticated +HTTP calls into the Solr pods it manages. The defining security fact is that +the operator is a **privileged intermediary**: it turns a namespaced, +relatively low-privilege action (creating a CR) into high-privilege cluster +mutations (creating Secrets, exec-ing into pods, managing StatefulSets), +across every namespace it watches (all namespaces by default). + +## §2 Scope and intended use + +The Solr Operator is a **long-running in-cluster controller**, not a library +and not a user-facing service. Roles: + +- **CRD author / namespace tenant** — a user (human or CI identity) with RBAC + permission to create/update `SolrCloud`, `SolrBackup`, + `SolrPrometheusExporter` objects in a watched namespace. **Semi-trusted at + most**: they author the *desired state* but do not themselves hold the + operator's cluster privileges. This is the primary adversary of interest + (§7). *(inferred — Q-tenant.)* +- **Cluster operator / admin** — installs the operator, grants its + `ClusterRole`, chooses watched namespaces, controls the Helm values. + **Fully trusted** — owns the operator's blast radius. *(inferred — + Q-admin.)* +- **The managed Solr (search server) and its clients** — out of scope here; + modelled by `apache/solr`'s `THREAT_MODEL.md`. The operator is a *client* of + Solr (it makes authenticated admin API calls), not the thing serving + queries. + +**Component families.** + +| Family | Entry point | Privilege / exposure | In model? | +| --- | --- | --- | --- | +| **CRD field handling** (`api/v1beta1`) | `SolrCloud`/`SolrBackup`/`SolrPrometheusExporter` spec | tenant-authored desired state consumed by a privileged controller | **Yes (primary)** | +| **Reconciliation controllers** (`controllers/`) | watch → reconcile loop | acts with the operator ServiceAccount's cluster RBAC | **Yes (primary)** | +| **Operator cluster RBAC** (`config/rbac/role.yaml`) | the `ClusterRole` bound to the operator SA | secrets/pods-exec/statefulsets cluster-wide | **Yes (blast radius)** | +| **Secret provisioning** (`controllers/util/solr_security_util.go`) | bootstrap basic-auth + `security.json` secrets | generates & stores Solr admin credentials | **Yes** | +| **TLS handling** (`solr_tls_util.go`, `main.go` client cert) | mounted/provisioned certs; operator→Solr mTLS client | trust of Solr server certs | **Yes** | +| **Backup subsystem** (`SolrBackup`, `solr_backup_repo_util.go`) | repo config + cloud credentials (S3/GCS/volume) | reads backup-repo credential secrets | **Yes** | +| **ZooKeeper coupling** | provisions `ZookeeperCluster` (pravega), ZK ACL secrets | cluster state/config store for SolrCloud | **Yes (trust ZK provider)** | +| Admission / validation webhooks | — | — | **No — none shipped** (§3) | +| **The managed Solr search server** | Solr HTTP API | query/index/admin | **No — `apache/solr` model** (§3) | +| Kubernetes control plane (API server, kubelet, etcd) | — | the platform | **No** (§3) | + +## §3 Out of scope (explicit non-goals) Review Comment: Out of scope is also custom Kubernetes Options passed to dependent resources (StatefulSet, Service, Pod, etc). These options are copied from Kubernetes and passed directly to the resources being created. ########## SECURITY.md: ########## @@ -0,0 +1,32 @@ +<!-- +Licensed to the Apache Software Foundation (ASF) under one +or more contributor license agreements. See the NOTICE file +distributed with this work for additional information +regarding copyright ownership. The ASF licenses this file +to you under the Apache License, Version 2.0 (the +"License"); you may not use this file except in compliance +with the License. You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, +software distributed under the License is distributed on an +"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +KIND, either express or implied. See the License for the +specific language governing permissions and limitations +under the License. +--> + +# Security Policy + +## Reporting a Vulnerability + +`apache/solr-operator` follows the [Apache Software Foundation security process](https://www.apache.org/security/). Please report suspected +vulnerabilities privately to `[email protected]`; do not open public Review Comment: Shouldn't this be `[email protected]`? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
