Repository navigation
sec/sec29-mantou：ServiceAccount 令牌与 Secret 更新语义 - #335
Merged
Merged
Conversation
- list/detail 只返回键名和值字节数（data_keys/string_data_keys/redacted）， data/string_data 保留键、值置空；YAML 中 data/stringData 值替换为 <redacted> - 三个接口都去掉 kubectl.kubernetes.io/last-applied-configuration 注解 - 新增 GET /api/k8s/secret/:cluster_id/:namespace/:name/reveal，每次调用同步写审计 （仅谁/何时/集群/命名空间/名称/键名，不含值），审计失败时不返回明文 - reveal 在接口目录登记为 k8s:secret:reveal，通配符授权不覆盖该接口 - 更新时回填脱敏值：表单空值保留原值，YAML 占位符还原原值，创建时拒绝占位符
- UpdateSecret：stringData 中值为空且集群已有非空值的键，不再作为 stringData 提交， 改为在 data 中保留原值，避免 K8s 合并 stringData 时清空 data（与 data 的空值保留规则一致） - reveal 审计记录 status_code 写实际结果（200/400/404/403/500），不再固定 200； 同步审计写入失败时返回 HTTP 500（ErrAuditWriteFailed），不含明文 - 显式授权路由只认 api.Path == FullPath 且方法一致的精确匹配， 参数化授权路径（:param）、具体请求路径、通配符均不覆盖 reveal - reveal 按 keys 过滤时，data 与 stringData 同名键两处都返回，与全量输出一致 - 补测试：stringData 占位符落到 data 的分支、data/stringData 同名键的脱敏/写回/reveal、 审计状态码、审计失败 500、参数化授权 403、admin 放行 - 同步更新 docs/release/k8s-secret-redaction.md
- GET /token 只返回注解 service-account.name/uid 与 SA 匹配的 token Secret，借挂的 Secret 被拒绝 - 创建/更新 SA 忽略请求中的 secrets 引用（记 Warn），更新保留集群现有引用；YAML 更新以 URL 的 name/namespace 为准 - GET/POST /token 加入显式授权精确匹配名单，权限码 k8s:serviceaccount:token / k8s:serviceaccount:token:create， 启动时登记到 cl_system_apis，已有自动名称行按条件改名 - 每次调用同步写 TOKEN_REVEAL / TOKEN_CREATE 审计（仅元数据），审计失败不返回 token（HTTP 500），响应 no-store - ServiceAccountService 注入 AuditService，重新生成 wire_gen.go - 文档 docs/release/k8s-serviceaccount-token.md
- renameAutoNamedPermission 的 WHERE 增加 description = '<METHOD> <path>'，管理员只改说明的行整行不动 - 读取现有行时一并读取 description - CreateInBatches(OnConflict DoNothing) 后核对本次登记的权限码，缺行记 Warn（只含权限码） - 测试：管理员只改说明不被覆盖、自动命名行正确改名、权限码冲突被跳过时告警
- YAML 带 metadata.resourceVersion 时严格乐观锁：只 Update 一次，冲突返回 BusinessError{ErrK8sResourceConflict}，
handler 经 respondBusinessError 映射为 HTTP 409 + code=1；不带版本保持 RetryOnConflict
- 新增 base.Conflict/ConflictError、constants.ErrK8sResourceConflict、utils/manager UpdateServiceAccountWithResourceVersion
- GetServiceAccountSecrets 改为接收已读取的 SA，GetServiceAccountToken / GetServiceAccountTokens 不再重复 Get
- TokenRequest 的 ExpirationTime 先 .UTC() 再格式化
- 测试：乐观锁过期/正确/无版本三条路径、409 映射、UTC 转换、SA 只读一次、末尾斜杠与大小写不能绕过 token 显式授权
- 旧 UpdateServiceAccount 方法保留（留给 SEC-30）
- preserveRedactedData：请求 data 为 nil（未携带/null）时保留集群现有 data；{} 表示删除全部 data 键
- preserveRedactedStringData：stringData 空串只在请求 data 为 nil 或包含该键时恢复原值，否则该键被删除
- 测试：键在 data 中→恢复、键不在→删除；data 为 nil→保留、data 为 {}→清空；更新原有用例到新语义
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
合入分支
sec/sec29-mantou，tiped683efb937f89be325ed0e9e1bb8874143185bf。SEC-29 ServiceAccount 更新使用 RetryOnConflict，TokenRequest 有效期校验与归属校验。包含 SEC-25 Secret 脱敏与更新语义（data 缺省保留，stringData 空串只恢复请求 data 中的键）。