Skip to content

feat(misc/hard): address security PR misc hard #1443

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
leninmehedy merged 3 commits into from
Oct 27, 2026
Merged

feat(misc/hard): address security PR misc hard #1443

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4699380
feat(api/misc): address low-med hard security
arturre Oct 26, 2026
e7460e3
fix(api/rbac): fix rbac
arturre Oct 26, 2026
2fe2955
fix(api): rm ConfigFolder
arturre Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# Selector stage: pick the pre-compiled binary for the target architecture.
# TARGETARCH is set by docker buildx to the target platform (amd64/arm64),
# which matches our binary suffix — unlike uname -m which reflects the builder.
FROM debian:bookworm-slim AS selector
FROM debian:bookworm-slim@sha256:7ff6ba31527b9e336162fa061746c366c4b2032f4d2cff2078bea43f78efe3f8 AS selector

ARG TARGETARCH

Expand All @@ -15,7 +15,7 @@ RUN cd /tmp && \
chmod +x /manager

# Final stage
FROM gcr.io/distroless/static-debian13:nonroot
FROM gcr.io/distroless/static-debian13:nonroot@sha256:18f4cc26c9ffa7f20a359298be7deadac5c607c8e03a02b8119f1a5fc2f82c99

WORKDIR /

Expand Down
4 changes: 2 additions & 2 deletions Dockerfile.beacon
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# Selector stage: pick the pre-compiled binary for the target architecture.
# TARGETARCH is set by docker buildx to the target platform (amd64/arm64),
# which matches our binary suffix — unlike uname -m which reflects the builder.
FROM debian:bookworm-slim AS selector
FROM debian:bookworm-slim@sha256:7ff6ba31527b9e336162fa061746c366c4b2032f4d2cff2078bea43f78efe3f8 AS selector

ARG TARGETARCH

Expand All @@ -30,7 +30,7 @@ RUN cd /tmp && \
# so any shared volume ownership lines up. The runtime user is still overridable
# per deployment via the pod/container securityContext, which takes precedence
# over this image USER.
FROM debian:bookworm-slim
FROM debian:bookworm-slim@sha256:7ff6ba31527b9e336162fa061746c366c4b2032f4d2cff2078bea43f78efe3f8

# Match the consensus-node and UC images: hedera group and user, both 2000.
RUN groupadd --gid 2000 hedera && \
Expand Down
4 changes: 2 additions & 2 deletions Dockerfile.uc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
# Selector stage: pick the pre-compiled binary for the target architecture.
# TARGETARCH is set by docker buildx to the target platform (amd64/arm64),
# which matches our binary suffix — unlike uname -m which reflects the builder.
FROM debian:bookworm-slim AS selector
FROM debian:bookworm-slim@sha256:7ff6ba31527b9e336162fa061746c366c4b2032f4d2cff2078bea43f78efe3f8 AS selector

ARG TARGETARCH

Expand All @@ -30,7 +30,7 @@ RUN cd /tmp && \
#
# We use debian:bookworm-slim (not distroless) so the image ships a shell for
# `kubectl exec` debugging of the shared upgrade tree.
FROM debian:bookworm-slim
FROM debian:bookworm-slim@sha256:7ff6ba31527b9e336162fa061746c366c4b2032f4d2cff2078bea43f78efe3f8

# Match the consensus-node image: hedera group and user, both 2000.
RUN groupadd --gid 2000 hedera && \
Expand Down
5 changes: 1 addition & 4 deletions api/v1alpha1/consensuscapsule_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,10 +128,6 @@ type ConsensusCapsuleSpec struct {
// +optional
NodeProperties map[string]string `json:"nodeProperties,omitempty"`

// hostPath volume containing config.txt
// +optional
ConfigFolder *corev1.HostPathVolumeSource `json:"configFolder,omitempty"`

// +kubebuilder:default=LoadBalancer
// +optional
ServiceType ServiceType `json:"serviceType,omitempty"`
Expand Down Expand Up @@ -166,6 +162,7 @@ type ConsensusCapsuleSpec struct {

// ConsensusSecrets holds TLS and signing key references.
type ConsensusSecrets struct {
// HostPath mounts node keys read-only from the host. Legacy; prefer secretResources.
// +optional
HostPath *corev1.HostPathVolumeSource `json:"hostPath,omitempty"`

Expand Down
3 changes: 3 additions & 0 deletions api/v1alpha1/envoyproxy_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,9 @@ type EnvoyProxySpec struct {

// Image is the Envoy container image.
// +kubebuilder:default="envoyproxy/envoy-distroless:v1.21.6"
// +kubebuilder:validation:MaxLength=512
// +kubebuilder:validation:XValidation:rule="self.matches('@sha256:[a-f0-9]{64}$') || self.matches(':[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$')",message="image must be pinned by a tag or a sha256 digest"
// +kubebuilder:validation:XValidation:rule="!self.lowerAscii().matches(':latest(@sha256:[a-f0-9]{64})?$')",message="image must not use the mutable 'latest' tag"
// +optional
Image string `json:"image,omitempty"`

Expand Down
3 changes: 3 additions & 0 deletions api/v1alpha1/haproxycapsule_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,9 @@ type HAProxyCapsuleSpec struct {

// Image is the HAProxy container image.
// +kubebuilder:default="haproxy:2.8.10-alpine3.20"
// +kubebuilder:validation:MaxLength=512
// +kubebuilder:validation:XValidation:rule="self.matches('@sha256:[a-f0-9]{64}$') || self.matches(':[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$')",message="image must be pinned by a tag or a sha256 digest"
// +kubebuilder:validation:XValidation:rule="!self.lowerAscii().matches(':latest(@sha256:[a-f0-9]{64})?$')",message="image must not use the mutable 'latest' tag"
// +optional
Image string `json:"image,omitempty"`

Expand Down
2 changes: 1 addition & 1 deletion api/v1alpha1/networkupgrade_common_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,7 +108,7 @@ type ImageRegistrySpec struct {
// Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
// e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
// "registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$`
// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$`
Image string `json:"image"`
// Per-registry layer hashes for non-deterministic builds.
// +optional
Expand Down
3 changes: 2 additions & 1 deletion api/v1alpha1/orbit_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,8 @@ type OrbitSpec struct {
// default image (relying on a default is not permitted under this policy). This is the
// opt-in, fresh-deploy counterpart to the always-on digest enforcement of the network
// upgrade flow; use it to guarantee digest-pinned images from day one rather than only
// after the first upgrade. Default false (tag-only images are allowed on deploy).
// after the first upgrade. Also applies to EnvoyProxy and HAProxyCapsule spec.image.
// Default false (tag-only images are allowed on deploy).
// +optional
RequireDigestOnDeploy bool `json:"requireDigestOnDeploy,omitempty"`

Expand Down
5 changes: 0 additions & 5 deletions api/v1alpha1/zz_generated.deepcopy.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

23 changes: 2 additions & 21 deletions config/crd/bases/operator.solo.hiero.org_consensuscapsules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,24 +89,6 @@ spec:
references a BootstrapProperties CR whose managed ConfigMap is subPath-mounted
at data/config/bootstrap.properties. Optional — CN falls back to defaults.
type: string
configFolder:
description: hostPath volume containing config.txt
properties:
path:
description: |-
path of the directory on the host.
If the path is a symlink, it will follow the link to the real path.
More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
type: string
type:
description: |-
type for HostPath Volume
Defaults to ""
More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath
type: string
required:
- path
type: object
desiredRunState:
description: |-
DesiredRunState is the desired s6 process state (Running or Stopped).
Expand Down Expand Up @@ -23278,9 +23260,8 @@ spec:
description: key/cert secret references
properties:
hostPath:
description: |-
Represents a host path mapped into a pod.
Host path volumes do not support ownership management or SELinux relabeling.
description: HostPath mounts node keys read-only from the host.
Legacy; prefer secretResources.
properties:
path:
description: |-
Expand Down
6 changes: 6 additions & 0 deletions config/crd/bases/operator.solo.hiero.org_envoyproxies.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1185,7 +1185,13 @@ spec:
image:
default: envoyproxy/envoy-distroless:v1.21.6
description: Image is the Envoy container image.
maxLength: 512
type: string
x-kubernetes-validations:
- message: image must be pinned by a tag or a sha256 digest
rule: self.matches('@sha256:[a-f0-9]{64}$') || self.matches(':[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$')
- message: image must not use the mutable 'latest' tag
rule: '!self.lowerAscii().matches('':latest(@sha256:[a-f0-9]{64})?$'')'
ingressSpec:
description: IngressSpec is required when serviceType is Ingress.
properties:
Expand Down
6 changes: 6 additions & 0 deletions config/crd/bases/operator.solo.hiero.org_haproxycapsules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1198,7 +1198,13 @@ spec:
image:
default: haproxy:2.8.10-alpine3.20
description: Image is the HAProxy container image.
maxLength: 512
type: string
x-kubernetes-validations:
- message: image must be pinned by a tag or a sha256 digest
rule: self.matches('@sha256:[a-f0-9]{64}$') || self.matches(':[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$')
- message: image must not use the mutable 'latest' tag
rule: '!self.lowerAscii().matches('':latest(@sha256:[a-f0-9]{64})?$'')'
ingressSpec:
description: IngressSpec is required when serviceType is Ingress.
properties:
Expand Down
12 changes: 6 additions & 6 deletions config/crd/bases/operator.solo.hiero.org_networkupgradeexecutes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -187,7 +187,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -263,7 +263,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -339,7 +339,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -415,7 +415,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -491,7 +491,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down
12 changes: 6 additions & 6 deletions config/crd/bases/operator.solo.hiero.org_networkupgradefreezes.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -187,7 +187,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -263,7 +263,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -339,7 +339,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -415,7 +415,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down Expand Up @@ -491,7 +491,7 @@ spec:
Image is a "registry[:port]/repository[:tag][@sha256:digest]" reference,
e.g. "ghcr.io/hashgraph/consensus-node:0.75.0" or
"registry.example.com:5000/consensus-node@sha256:<64 hex chars>".
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+)?(@sha256:[a-f0-9]{64})?$
pattern: ^[a-zA-Z0-9]([a-zA-Z0-9._-]*[a-zA-Z0-9])?(:[0-9]+)?(/[a-zA-Z0-9._-]+)+(:[a-zA-Z0-9._-]+(@sha256:[a-f0-9]{64})?|@sha256:[a-f0-9]{64})$
type: string
layerHashes:
additionalProperties:
Expand Down
Loading
Loading