jcoffey-dev
3eb0f4c589
RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
82 lines
2.7 KiB
Go
82 lines
2.7 KiB
Go
// Command tenant-operator runs the Tenant CRD controller (see
|
|
// internal/controller/tenant_controller.go's doc comment for exactly
|
|
// what it does and doesn't manage). Same "cmd/<service>/main.go"
|
|
// convention as every other Go service in this repo
|
|
// (api/cmd/api, enterprise/cmd/enterprise-auth), rather than
|
|
// kubebuilder's newer default of a bare cmd/main.go.
|
|
package main
|
|
|
|
import (
|
|
"flag"
|
|
"os"
|
|
|
|
"k8s.io/apimachinery/pkg/runtime"
|
|
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
|
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
|
|
ctrl "sigs.k8s.io/controller-runtime"
|
|
"sigs.k8s.io/controller-runtime/pkg/healthz"
|
|
"sigs.k8s.io/controller-runtime/pkg/log/zap"
|
|
"sigs.k8s.io/controller-runtime/pkg/metrics/server"
|
|
|
|
sentryv1alpha1 "github.com/sentry/sentry/deploy/operator/api/v1alpha1"
|
|
"github.com/sentry/sentry/deploy/operator/internal/controller"
|
|
)
|
|
|
|
var scheme = runtime.NewScheme()
|
|
|
|
func init() {
|
|
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
|
|
utilruntime.Must(sentryv1alpha1.AddToScheme(scheme))
|
|
}
|
|
|
|
func main() {
|
|
var metricsAddr, probeAddr string
|
|
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metrics endpoint binds to.")
|
|
flag.StringVar(&probeAddr, "health-probe-bind-address", ":8081", "The address the health probe endpoint binds to.")
|
|
opts := zap.Options{Development: false}
|
|
opts.BindFlags(flag.CommandLine)
|
|
flag.Parse()
|
|
|
|
logger := zap.New(zap.UseFlagOptions(&opts))
|
|
ctrl.SetLogger(logger)
|
|
|
|
mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
|
|
Scheme: scheme,
|
|
Metrics: server.Options{BindAddress: metricsAddr},
|
|
HealthProbeBindAddress: probeAddr,
|
|
// A single tenant-operator replica reconciling cluster-wide state
|
|
// is enough at this scope (see internal/controller's doc comment
|
|
// on what it does and doesn't manage) -- leader election matters
|
|
// once a second replica could double-generate a Secret, not
|
|
// before.
|
|
LeaderElection: false,
|
|
})
|
|
if err != nil {
|
|
logger.Error(err, "unable to start manager")
|
|
os.Exit(1)
|
|
}
|
|
|
|
if err := (&controller.TenantReconciler{
|
|
Client: mgr.GetClient(),
|
|
Scheme: mgr.GetScheme(),
|
|
}).SetupWithManager(mgr); err != nil {
|
|
logger.Error(err, "unable to create controller", "controller", "Tenant")
|
|
os.Exit(1)
|
|
}
|
|
|
|
if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
|
|
logger.Error(err, "unable to set up health check")
|
|
os.Exit(1)
|
|
}
|
|
if err := mgr.AddReadyzCheck("readyz", healthz.Ping); err != nil {
|
|
logger.Error(err, "unable to set up ready check")
|
|
os.Exit(1)
|
|
}
|
|
|
|
logger.Info("starting tenant-operator")
|
|
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
|
|
logger.Error(err, "problem running manager")
|
|
os.Exit(1)
|
|
}
|
|
}
|