villebro opened a new pull request, #331: URL: https://github.com/apache/superset-kubernetes-operator/pull/331
## Summary Four independent low-severity findings from a Claude security scan, each a small blast-radius / consistency hardening with no shared root cause. ## Details - **Leader-election Role granted unused ConfigMap CRUD.** controller-runtime defaults to the Leases lock and `cmd/main.go` never selects a ConfigMap lock, so the grant is dead. Removed from the Kustomize Role and the Helm chart twin (snapshots regenerated); the manager ClusterRole's legitimate ConfigMap access is unchanged. - **Reserved `superset.apache.org/` labels were forgeable on Deployment/Service metadata.** Only pod templates were stripped, so a CR author could stamp another instance's parent label onto their Deployment/Service object metadata. `MergeDeploymentTemplate` now strips reserved labels (covering Deployment metadata via the resolver), and the two Service metadata merges strip them via the newly exported `resolution.StripReservedLabels`. *(Residual: Ingress/HTTPRoute user-label merges still pass non-parent reserved keys — candidate follow-up.)* - **Credential redaction missed quoted-key formats.** `credentialAssignmentRe` couldn't match JSON / Python-dict-repr forms (`"password": "x"`, `'db_password': 'x'`) — the closing quote sits between the keyword and the separator — a whole serialization class. Added `quotedKeyCredentialRe` (also covering `authorization`) that masks the quoted value in full with a bare placeholder, keeping redaction idempotent even on adversarial unbalanced-quote input; added quoted-key cases to the unit and fuzz corpora. - **User pod annotations could override the operator config-checksum annotation.** `buildDeploymentSpec` merged user pod-template annotations last, so a CR author could pin `superset.apache.org/config-checksum` and freeze rollouts (config and SECRET_KEY rotations stop rolling pods while status misreports as reconciled). The merge order now applies operator annotations last (matching the label rule and the lifecycle task-Job path). Also covers the maintenance-page Deployment (same builder). ## Release notes - Instances that had pinned the `superset.apache.org/config-checksum` pod annotation roll once on upgrade as the operator's computed checksum reasserts itself. Found via a Claude security scan. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
