fix: remove t.Parallel() from DNS resolver tests that mutate shared g…#42
Merged
Conversation
…lobal TestDNSPeerResolver_CachesResults and TestDNSPeerResolver_FiltersUnsafeIPs both write to package-level lookupHostFn, causing a data race when run concurrently. Remove t.Parallel() since they mutate shared state.
- Add advisory comment documenting SLSA generator tag-pin limitation - Sign Helm OCI artifact by digest (from helm push output) not tag - Add validation on values_override rejecting security-critical fields - Replace Argo CD default project with dedicated restricted AppProject - Constrain Flux OCIRepository semver to >=1.2.0 <2.0.0 - Pin Envoy gateway image to specific patch version v1.32.3 - Add pessimistic upper bounds on Terraform provider constraints
Implement pkg/authz/spicedb — a Zanzibar-style ReBAC authorizer that adapts an external SpiceDB instance via its gRPC CheckPermission API. - Registered as type 'spicedb' via init() in the module registry - Config: endpoint, token, insecure flag, timeout, check templates (resourceType, resourceId, permission, subjectType, subjectId) - Go text/template rendering for all check fields - upstream.Guard integration (circuit breaker + retry budget) - Composes under composite/anyOf exactly like openfga - Full test coverage: allow/deny, upstream errors, config validation, empty fields, breaker trip
- Add recover() wrapper on template execution to prevent panics from crashing goroutines on unexpected claim types - Use missingkey=error template option to surface missing map keys as errors instead of silent empty values - Cap rendered template output at 1024 chars (matches SpiceDB ObjectId limit) to prevent unnecessary memory allocation on oversized inputs - Replace detailed deny reasons with generic 'permission denied' message to avoid leaking internal resource graph structure; log details at debug level only - Add gRPC MaxCallRecvMsgSize(256KiB) to prevent memory amplification from compromised/misbehaving SpiceDB servers (default was 4MB) - Add configurable consistency mode (minimize_latency or fully_consistent) so operators can choose strong consistency for security-critical paths - Handle PERMISSIONSHIP_CONDITIONAL explicitly as ErrUpstream rather than silently treating caveated permissions as denies - Reject zero/negative timeout at construction time - Log slog.Warn when insecure mode is configured (token in plaintext)
Implement OCI-based policy bundle packaging and distribution: - pkg/bundle: Pack/Unpack/Push/Pull with ORAS v2, 10MiB size limit, path traversal and tar bomb protection - cmd/lwauthctl bundle: push, pull, pack, inspect subcommands with env var credential fallback - Three reference bundles: owasp-ratelimit, pci-dss-baseline, gdpr-audit - Full test coverage for Pack/Unpack round-trip, validation, size limits - DESIGN.md updated to mark F6 and F7 as shipped
Bundle (pkg/bundle): - Reject symlinks and hardlinks in tar entries (BN1) - Validate resolved path stays within destDir on all platforms (BN2) - Wrap gzip reader with LimitReader to cap decompression (BN5) - Limit tar entries to 1000 to prevent inode exhaustion (BN6) CLI (cmd/lwauthctl): - Warn when --password flag exposes credentials in process listing (BN3) SpiceDB (pkg/authz/spicedb): - Add sanitize template function for SpiceDB-safe object IDs (SP5) Reference bundles: - Document peer-ip vs X-Forwarded-For trade-off in owasp-ratelimit (BN7)
Implement cross-cluster config replication and revocation sync: - api/proto: Federation gRPC service (SyncConfig, PushRevocation, Ping) - pkg/federation: Config, Server, Peer, PeerSet with HMAC-SHA256 signing, version monotonicity, snapshot size limits (16 MiB) - api/crd: ClusterPeer cluster-scoped CRD for declaring remote peers - internal/controller: ClusterPeerReconciler watches CRDs, updates status - cmd/lwauthctl federation: generate-key and status subcommands - 16 tests covering sign/verify, pub/sub, stale rejection, broadcast - DESIGN.md updated to mark F8 as shipped
- HMAC now covers full snapshot payload (version, source, timestamp, spec) preventing replay attacks with manipulated version numbers (FD1) - Subscribe restricted to known peers only; unknown cluster IDs rejected (FD2/FD3) - Re-subscribe safely closes existing channel before creating new one - Version reset recovery: accept lower version if timestamp is newer (FD5) - Max federation key length (256 bytes) to prevent CPU amplification (FD6) - Revocation key length checked before HMAC computation (fail-fast) (FD7) - 5 new tests: unknown peer rejection, key too long, version reset recovery, full-payload sign/verify tampering, revocation key length ordering
Sandboxed in-process extension runtime using wazero (pure-Go). Plugins compiled to .wasm can implement Identifier, Authorizer, or ResponseMutator via a JSON-in/JSON-out ABI over exported functions. Sandbox enforces: - CPU: fuel metering (default 1M instructions per call) - Memory: configurable cap (default 16 MiB) - Wall-clock: context deadline (default 100ms) - Response size: 1 MiB max Registered under type name 'wasm' in the module registry. WASI preview1 available for modules needing stdlib (clocks, random). New package: pkg/plugin/wasm/ New dependency: github.com/tetratelabs/wazero v1.11.0
Implements DOC-README-1: each README follows the standard format with H1 title, one-sentence purpose, Go code example, configuration table, feature bullets, and how-it-works explanation. Packages covered: - identity: jwt, oauth2, apikey, mtls, hmac, introspection, dpop - authz: rbac, opa, openfga, cel, composite, spicedb - mutator: headers, jwtissue - core: session, revocation, ratelimit, keyrotation, upstream - plugins: grpc, wasm - infra: configstream, client/go, buildinfo, lwauthd, bundle, federation - observability: audit, metrics, tracing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…lobal
TestDNSPeerResolver_CachesResults and TestDNSPeerResolver_FiltersUnsafeIPs both write to package-level lookupHostFn, causing a data race when run concurrently. Remove t.Parallel() since they mutate shared state.