Rate-limit the /v1/rotate endpoint#1971
Conversation
The /v1/rotate handler was registered without the throttled rate limiter that /v1/verify uses. Since rotate performs a full RSA-OAEP decrypt + re-encrypt on every request, an authenticated cluster user who can reach the endpoint via the kube-apiserver proxy can drive the controller's CPU to 100% and stall SealedSecret reconciliation cluster-wide. Wraps the rotate handler in the same httpRateLimiter.RateLimit(...) chain used for verify. Updates the help text on --rate-limit and --rate-limit-burst to reflect that both endpoints are now covered. Reported in GHSA-jpp5-6cf2-prqh. Signed-off-by: 0xVijay <53905346+0xVijay@users.noreply.github.com>
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
Due to the lack of activity in the last 7 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
|
please @0xVijay Could you sign off the patches, please?. DCO is failing |
aa3f83e to
f950408
Compare
|
Done @alvneiayu |
|
This Pull Request has been automatically marked as "stale" because it has not had recent activity (for 15 days). It will be closed if no further activity occurs. Thank you for your contribution. |
|
Due to the lack of activity in the last 7 days since it was marked as "stale", we proceed to close this Pull Request. Do not hesitate to reopen it later if necessary. |
2 participants
What this does
Wraps the
/v1/rotatehandler in the samehttpRateLimiter.RateLimit(...)chain that/v1/verifyalready uses, and clarifies the help text on--rate-limit/--rate-limit-burstto reflect that both endpoints are covered.Why
/v1/rotatedecrypts a SealedSecret with the controller's private key and re-encrypts it with the latest sealing key — a full RSA-OAEP decrypt + re-encrypt on every request. The default Helm chart bindssystem:authenticatedto the proxier role, so any user with a valid cluster credential can reach the endpoint via the kube-apiserver proxy and flood it. The CPU goes to 100% and SealedSecret reconciliation stalls across the whole cluster./v1/verifywas already rate-limited atpkg/controller/server.go:49. Rotate just needs the same wrapper.This was discussed in advisory GHSA-jpp5-6cf2-prqh — @alvneiayu accepted it as a genuine improvement and suggested opening a regular issue / PR. Sending the PR directly.
Change
Plus a one-word help-text update on the two existing rate-limit flags so the docs match the behaviour.
Notes
--rate-limit/--rate-limit-burstquotas so deployments don't need configuration changes.429 Too Many Requestsonce the per-source GCRA bucket is exhausted.