Skip to content

Commit 0d2389e

Browse files
lexfreilexfrei
committed
fix(seaweedfs): enforce read-only bucket access by bumping cosi-driver to v0.3.1
The seaweedfs COSI driver shipped at v0.1.2 hardcodes read-write S3 actions (Read, Write, List, Tagging) for every BucketAccess and never reads the accessPolicy parameter. The chart already defines a -readonly BucketAccessClass carrying parameters.accessPolicy: readonly, but v0.1.2 ignores it, so a credential meant to be read-only can still write (upload and delete) objects. Bump the driver to v0.3.1, which honours accessPolicy: readonly by issuing Read,List-only credentials (read-write and the empty default stay Read,Write,List,Tagging). The override lives in the package values.yaml rather than the vendored chart so it survives make update; the sister extra/seaweedfs chart already runs v0.3.1. Assisted-By: Claude <[email protected]> Signed-off-by: Aleksei Sviridkin <[email protected]>
1 parent 4404c5c commit 0d2389e

2 files changed

Lines changed: 43 additions & 0 deletions

File tree

‎packages/system/seaweedfs/tests/cosi_image_test.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
suite: seaweedfs COSI driver image pin
2+
3+
# Pins the COSI driver image to a release that enforces read-only bucket access.
4+
#
5+
# The vendored chart default is seaweedfs-cosi-driver v0.1.2 (see
6+
# charts/seaweedfs/values.yaml), which hardcodes read-write S3 actions for every
7+
# BucketAccess and ignores the accessPolicy parameter. The chart ships a
8+
# -readonly BucketAccessClass with parameters.accessPolicy: readonly, so on
9+
# v0.1.2 a credential meant to be read-only is silently granted read-write.
10+
# The package values.yaml overrides cosi.image to v0.3.1, which honours
11+
# accessPolicy: readonly.
12+
#
13+
# This test does not set the image itself; it relies on the package values.yaml
14+
# override, so it goes red if that override is removed and the image falls back
15+
# to the vulnerable v0.1.2 — turning a silent security regression into a build
16+
# failure. Note: `make update` re-vendors charts/ and resets the vendored
17+
# default to v0.1.2 but does not touch the package values.yaml, so the override
18+
# (and this guard) must be preserved across any re-vendor.
19+
20+
templates:
21+
- charts/seaweedfs/templates/cosi/cosi-deployment.yaml
22+
23+
release:
24+
name: seaweedfs
25+
namespace: cozy-seaweedfs
26+
27+
tests:
28+
- it: pins the cosi-driver container to v0.3.1 (read-only access enforcement)
29+
template: charts/seaweedfs/templates/cosi/cosi-deployment.yaml
30+
set:
31+
seaweedfs.cosi.enabled: true
32+
asserts:
33+
- equal:
34+
path: spec.template.spec.containers[0].name
35+
value: seaweedfs-cosi-driver
36+
- equal:
37+
path: spec.template.spec.containers[0].image
38+
value: ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1

‎packages/system/seaweedfs/values.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,6 +204,11 @@ seaweedfs:
204204
topologyKey: kubernetes.io/hostname
205205
cosi:
206206
enabled: true
207+
# Override the vendored chart default (v0.1.2), which hardcodes read-write
208+
# S3 actions for every BucketAccess and ignores the accessPolicy parameter.
209+
# v0.3.x honours accessPolicy: readonly, so a -readonly BucketAccessClass
210+
# actually issues read-only (Read,List) credentials instead of read-write.
211+
image: "ghcr.io/seaweedfs/seaweedfs-cosi-driver:v0.3.1"
207212
podLabels:
208213
policy.cozystack.io/allow-to-apiserver: "true"
209214
driverName: "seaweedfs.objectstorage.k8s.io"

0 commit comments

Comments
 (0)