fix(security): resolve team references on every reconcile - #160
Conversation
Crossplane resolves a reference only when the corresponding field is empty unless told otherwise, so an allow-listed teamIdRef sitting beside a directly authored teamId is decorative — the numeric value is what reconciles, and a by-name allow-list cannot constrain it. Set teamIdRef.policy.resolve to Always on all 39 TeamMembership and TeamRepository resources so the referenced team always wins. No manifest here authors a teamId, so nothing is re-pointed by this change; it closes the bypass rather than altering any current grant. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@coderabbitai review |
|
✅ Action performedReview finished.
|
Readiness evidence — exercised against the live cluster, not reasoned about1. The field is schema-valid and its semantics are exactly the intent. Read off the live CRD Note the sibling 2. Every live resource is currently on the default. All 39 3. No grant moves — proven by matching IDs, not assumed. This is the claim worth checking, since It does not. The two sides reconcile exactly:
Every live 4. What is deliberately not claimed. Acceptance criterion 3 of platform#3195 — that a resource |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (39)
Included review availability: Your plan includes up to 1 review per rolling hour; 0 remain after this review. 📜 Recent review details🧰 Additional context used📓 Path-based instructions (1)deploy/**/*.{yaml,yml}📄 CodeRabbit inference engine (AGENTS.md)
Files:
🔇 Additional comments (40)
📝 WalkthroughWalkthroughAdded 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Readiness confirmed at
Pentad: 0 failing checks, 0 unresolved threads, 0 review findings, |
1 participant
Why
Our GitHub teams and repository grants are managed declaratively here, and the control that says
which team a grant may target is the team's name. That control does not currently hold:
Crossplane only resolves a name reference when the numeric ID beside it is empty, so a manifest
carrying an allow-listed team name and a directly written team ID would quietly reconcile
against the ID — the name would be decorative. Anything reviewing the name would see an approved
grant while a different team was actually being granted.
This is the change that closes that gap, and it is the prerequisite for the platform-side policy
that enforces the allow-list (platform#3195,
which blocks platform#2718).
What
Tells Crossplane to re-resolve the team reference on every reconcile, on all 39 team memberships and
repository grants, so the referenced team always wins over any ID sitting next to it.
No grant changes. Checked against the live cluster rather than assumed: every deployed resource
already points at exactly the team its name refers to (23 to
admins, 16 tomaintainers, matchingthe manifests one for one). Re-resolving therefore produces the identical result today. The effect
is entirely about what becomes impossible in future.
Merge order
This must land before platform#2718 starts requiring the field, or all 39 resources would be
rejected. That sequencing is why this PR exists separately.
Fixes #3195 is deliberately not used here — that issue lives in
devantler-tech/platformandalso covers the platform-side policy change, which is not in this diff. Part of platform#3195.