fix: add serviceaccount validation for tenantowners and tenants (#1966)

* fix(controller): decode old object for delete requests Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * chore: modernize golang Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * fix: preserve ca-bundles injected from external providers Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: add serviceaccount validation for tenantowners and tenants Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix: add serviceaccount validation for tenantowners and tenants Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix(sec): add namespace termination interception Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix(sec): add namespace termination interception Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: correct sa check Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * fix(sec): add namespace termination interception Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
2026-08-25 16:07:24 +00:00 · 2026-06-17 06:32:02 +02:00
parent 775115d9ea
commit af2f37793e
21 changed files with 948 additions and 156 deletions
@@ -14,6 +14,7 @@ import (
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apiserver/pkg/authentication/serviceaccount"
 	"k8s.io/client-go/rest"
 	"sigs.k8s.io/controller-runtime/pkg/client"

@@ -164,6 +165,18 @@ func (c *capsuleConfiguration) Users() rbac.UserListSpec {
 	out := rbac.UserListSpec{}

 	for _, user := range c.UserNames() {
+		// Old Spec.UserNames may contain ServiceAccount usernames.
+		// If SplitUsername succeeds, the value is a ServiceAccount.
+		_, _, err := serviceaccount.SplitUsername(user)
+		if err == nil {
+			out.Upsert(rbac.UserSpec{
+				Kind: rbac.ServiceAccountOwner,
+				Name: user,
+			})
+
+			continue
+		}
+
 		out.Upsert(rbac.UserSpec{
 			Kind: rbac.UserOwner,
 			Name: user,
@@ -86,3 +86,14 @@ func GetOwnersWithKinds(tenant *capsulev1beta2.Tenant) (owners []string) {
 func OwnerKindIndexKey(kind, name string) string {
 	return fmt.Sprintf("%s:%s", kind, name)
 }
+
+func ValidateTenantOwner(owner rbac.UserSpec) error {
+	if owner.Kind == rbac.ServiceAccountOwner {
+		_, _, err := serviceaccount.SplitUsername(owner.Name)
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
@@ -97,3 +97,133 @@ func TestGetOwnersWithKinds_EmptyNameStillIncluded(t *testing.T) {
 		t.Fatalf("unexpected owners:\nwant=%v\ngot =%v", want, owners)
 	}
 }
+
+func TestValidateTenantOwner(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		owner   rbac.CoreOwnerSpec
+		wantErr bool
+	}{
+		{
+			name: "valid service account owner",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.ServiceAccountOwner,
+					Name: "system:serviceaccount:tenant-a:builder",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "invalid service account owner without serviceaccount prefix",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.ServiceAccountOwner,
+					Name: "tenant-a:builder",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid service account owner with missing namespace",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.ServiceAccountOwner,
+					Name: "system:serviceaccount::builder",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid service account owner with missing name",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.ServiceAccountOwner,
+					Name: "system:serviceaccount:tenant-a:",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "invalid service account owner with plain name",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.ServiceAccountOwner,
+					Name: "builder",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "user owner is not validated as service account",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.UserOwner,
+					Name: "alice",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "group owner is not validated as service account",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.GroupOwner,
+					Name: "developers",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty user owner name is currently accepted",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.UserOwner,
+					Name: "",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty group owner name is currently accepted",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+					Kind: rbac.GroupOwner,
+					Name: "",
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "empty service account owner name is rejected",
+			owner: rbac.CoreOwnerSpec{
+				UserSpec: rbac.UserSpec{
+
+					Kind: rbac.ServiceAccountOwner,
+					Name: "",
+				},
+			},
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			err := tenant.ValidateTenantOwner(tt.owner.UserSpec)
+
+			if tt.wantErr && err == nil {
+				t.Fatalf("ValidateTenantOwner() expected error, got nil")
+			}
+
+			if !tt.wantErr && err != nil {
+				t.Fatalf("ValidateTenantOwner() unexpected error: %v", err)
+			}
+		})
+	}
+}