From 829a1227b625c30c0640cf2b8f6330b3abd8ef67 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 18 Aug 2026 05:23:37 +0200 Subject: [PATCH] fix(security): resolve team references on every reconcile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Crossplane resolves a reference only when the corresponding field is empty unless told otherwise, so an allow-listed teamIdRef sitting beside a directly authored teamId is decorative — the numeric value is what reconciles, and a by-name allow-list cannot constrain it. Set teamIdRef.policy.resolve to Always on all 39 TeamMembership and TeamRepository resources so the referenced team always wins. No manifest here authors a teamId, so nothing is re-pointed by this change; it closes the bypass rather than altering any current grant. Co-Authored-By: Claude Opus 5 (1M context) --- deploy/team-memberships/add-devantler-to-admins.yaml | 2 ++ deploy/team-memberships/add-devantler-to-maintainers.yaml | 2 ++ deploy/team-repositories/grant-admins-on-actions.yaml | 2 ++ deploy/team-repositories/grant-admins-on-agent-plugins.yaml | 2 ++ deploy/team-repositories/grant-admins-on-agent-skills.yaml | 2 ++ deploy/team-repositories/grant-admins-on-ascoachingogvaner.yaml | 2 ++ deploy/team-repositories/grant-admins-on-aws.yaml | 2 ++ deploy/team-repositories/grant-admins-on-doggy-countdown.yaml | 2 ++ deploy/team-repositories/grant-admins-on-dot-github.yaml | 2 ++ deploy/team-repositories/grant-admins-on-dotnet-template.yaml | 2 ++ deploy/team-repositories/grant-admins-on-fleet-gitops.yaml | 2 ++ deploy/team-repositories/grant-admins-on-go-template.yaml | 2 ++ deploy/team-repositories/grant-admins-on-homebrew-tap.yaml | 2 ++ deploy/team-repositories/grant-admins-on-ksail.yaml | 2 ++ deploy/team-repositories/grant-admins-on-kyverno-policies.yaml | 2 ++ deploy/team-repositories/grant-admins-on-maintenance.yaml | 2 ++ deploy/team-repositories/grant-admins-on-monorepo.yaml | 2 ++ deploy/team-repositories/grant-admins-on-platform-template.yaml | 2 ++ .../grant-admins-on-platform-tenant-template.yaml | 2 ++ deploy/team-repositories/grant-admins-on-platform.yaml | 2 ++ .../team-repositories/grant-admins-on-provider-upjet-unifi.yaml | 2 ++ deploy/team-repositories/grant-admins-on-unifi.yaml | 2 ++ deploy/team-repositories/grant-admins-on-wedding-app.yaml | 2 ++ deploy/team-repositories/grant-admins-on-world-at-ruin.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-actions.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-aws.yaml | 2 ++ .../team-repositories/grant-maintainers-on-doggy-countdown.yaml | 2 ++ .../team-repositories/grant-maintainers-on-dotnet-template.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-go-template.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-ksail.yaml | 2 ++ .../grant-maintainers-on-kyverno-policies.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-monorepo.yaml | 2 ++ .../grant-maintainers-on-platform-template.yaml | 2 ++ .../grant-maintainers-on-platform-tenant-template.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-platform.yaml | 2 ++ .../grant-maintainers-on-provider-upjet-unifi.yaml | 2 ++ deploy/team-repositories/grant-maintainers-on-unifi.yaml | 2 ++ .../team-repositories/grant-maintainers-on-world-at-ruin.yaml | 2 ++ 39 files changed, 78 insertions(+) diff --git a/deploy/team-memberships/add-devantler-to-admins.yaml b/deploy/team-memberships/add-devantler-to-admins.yaml index 62e480d..275bc16 100644 --- a/deploy/team-memberships/add-devantler-to-admins.yaml +++ b/deploy/team-memberships/add-devantler-to-admins.yaml @@ -8,6 +8,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always username: devantler role: maintainer providerConfigRef: diff --git a/deploy/team-memberships/add-devantler-to-maintainers.yaml b/deploy/team-memberships/add-devantler-to-maintainers.yaml index fa34971..240154d 100644 --- a/deploy/team-memberships/add-devantler-to-maintainers.yaml +++ b/deploy/team-memberships/add-devantler-to-maintainers.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always username: devantler role: maintainer providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-actions.yaml b/deploy/team-repositories/grant-admins-on-actions.yaml index 99fe03c..dcc6a31 100644 --- a/deploy/team-repositories/grant-admins-on-actions.yaml +++ b/deploy/team-repositories/grant-admins-on-actions.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: actions permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-agent-plugins.yaml b/deploy/team-repositories/grant-admins-on-agent-plugins.yaml index f0e8c55..5f881b5 100644 --- a/deploy/team-repositories/grant-admins-on-agent-plugins.yaml +++ b/deploy/team-repositories/grant-admins-on-agent-plugins.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: agent-plugins permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-agent-skills.yaml b/deploy/team-repositories/grant-admins-on-agent-skills.yaml index d324302..f7cecd3 100644 --- a/deploy/team-repositories/grant-admins-on-agent-skills.yaml +++ b/deploy/team-repositories/grant-admins-on-agent-skills.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: agent-skills permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-ascoachingogvaner.yaml b/deploy/team-repositories/grant-admins-on-ascoachingogvaner.yaml index 4571621..c87b566 100644 --- a/deploy/team-repositories/grant-admins-on-ascoachingogvaner.yaml +++ b/deploy/team-repositories/grant-admins-on-ascoachingogvaner.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: ascoachingogvaner permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-aws.yaml b/deploy/team-repositories/grant-admins-on-aws.yaml index f758dd0..7cdc603 100644 --- a/deploy/team-repositories/grant-admins-on-aws.yaml +++ b/deploy/team-repositories/grant-admins-on-aws.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: aws permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-doggy-countdown.yaml b/deploy/team-repositories/grant-admins-on-doggy-countdown.yaml index d2c7464..61370e2 100644 --- a/deploy/team-repositories/grant-admins-on-doggy-countdown.yaml +++ b/deploy/team-repositories/grant-admins-on-doggy-countdown.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: doggy-countdown permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-dot-github.yaml b/deploy/team-repositories/grant-admins-on-dot-github.yaml index 16faeb3..67ba766 100644 --- a/deploy/team-repositories/grant-admins-on-dot-github.yaml +++ b/deploy/team-repositories/grant-admins-on-dot-github.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: .github permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-dotnet-template.yaml b/deploy/team-repositories/grant-admins-on-dotnet-template.yaml index d9d999e..6bc2bfe 100644 --- a/deploy/team-repositories/grant-admins-on-dotnet-template.yaml +++ b/deploy/team-repositories/grant-admins-on-dotnet-template.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: dotnet-template permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-fleet-gitops.yaml b/deploy/team-repositories/grant-admins-on-fleet-gitops.yaml index 9baaa05..f072043 100644 --- a/deploy/team-repositories/grant-admins-on-fleet-gitops.yaml +++ b/deploy/team-repositories/grant-admins-on-fleet-gitops.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: fleet-gitops permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-go-template.yaml b/deploy/team-repositories/grant-admins-on-go-template.yaml index 52a0ec8..5417329 100644 --- a/deploy/team-repositories/grant-admins-on-go-template.yaml +++ b/deploy/team-repositories/grant-admins-on-go-template.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: go-template permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-homebrew-tap.yaml b/deploy/team-repositories/grant-admins-on-homebrew-tap.yaml index a7b1357..263fdd0 100644 --- a/deploy/team-repositories/grant-admins-on-homebrew-tap.yaml +++ b/deploy/team-repositories/grant-admins-on-homebrew-tap.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: homebrew-tap permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-ksail.yaml b/deploy/team-repositories/grant-admins-on-ksail.yaml index fe4d5e8..ad1e1e2 100644 --- a/deploy/team-repositories/grant-admins-on-ksail.yaml +++ b/deploy/team-repositories/grant-admins-on-ksail.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: ksail permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-kyverno-policies.yaml b/deploy/team-repositories/grant-admins-on-kyverno-policies.yaml index 5c13d6e..0a1d711 100644 --- a/deploy/team-repositories/grant-admins-on-kyverno-policies.yaml +++ b/deploy/team-repositories/grant-admins-on-kyverno-policies.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: kyverno-policies permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-maintenance.yaml b/deploy/team-repositories/grant-admins-on-maintenance.yaml index b78dea9..5209ce7 100644 --- a/deploy/team-repositories/grant-admins-on-maintenance.yaml +++ b/deploy/team-repositories/grant-admins-on-maintenance.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: maintenance permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-monorepo.yaml b/deploy/team-repositories/grant-admins-on-monorepo.yaml index 5512e85..bdc8d78 100644 --- a/deploy/team-repositories/grant-admins-on-monorepo.yaml +++ b/deploy/team-repositories/grant-admins-on-monorepo.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: monorepo permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-platform-template.yaml b/deploy/team-repositories/grant-admins-on-platform-template.yaml index 85f2d2f..f816062 100644 --- a/deploy/team-repositories/grant-admins-on-platform-template.yaml +++ b/deploy/team-repositories/grant-admins-on-platform-template.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: platform-template permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-platform-tenant-template.yaml b/deploy/team-repositories/grant-admins-on-platform-tenant-template.yaml index 70060f2..6f4ad34 100644 --- a/deploy/team-repositories/grant-admins-on-platform-tenant-template.yaml +++ b/deploy/team-repositories/grant-admins-on-platform-tenant-template.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: platform-tenant-template permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-platform.yaml b/deploy/team-repositories/grant-admins-on-platform.yaml index b48a990..f1db265 100644 --- a/deploy/team-repositories/grant-admins-on-platform.yaml +++ b/deploy/team-repositories/grant-admins-on-platform.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: platform permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-provider-upjet-unifi.yaml b/deploy/team-repositories/grant-admins-on-provider-upjet-unifi.yaml index 3df07fa..092de6d 100644 --- a/deploy/team-repositories/grant-admins-on-provider-upjet-unifi.yaml +++ b/deploy/team-repositories/grant-admins-on-provider-upjet-unifi.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: provider-upjet-unifi permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-unifi.yaml b/deploy/team-repositories/grant-admins-on-unifi.yaml index f6f1d9f..7f5c753 100644 --- a/deploy/team-repositories/grant-admins-on-unifi.yaml +++ b/deploy/team-repositories/grant-admins-on-unifi.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: unifi permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-wedding-app.yaml b/deploy/team-repositories/grant-admins-on-wedding-app.yaml index 29d4abe..e295572 100644 --- a/deploy/team-repositories/grant-admins-on-wedding-app.yaml +++ b/deploy/team-repositories/grant-admins-on-wedding-app.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: wedding-app permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-admins-on-world-at-ruin.yaml b/deploy/team-repositories/grant-admins-on-world-at-ruin.yaml index bdd8ee4..c093827 100644 --- a/deploy/team-repositories/grant-admins-on-world-at-ruin.yaml +++ b/deploy/team-repositories/grant-admins-on-world-at-ruin.yaml @@ -10,6 +10,8 @@ spec: forProvider: teamIdRef: name: admins + policy: + resolve: Always repository: world-at-ruin permission: admin providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-actions.yaml b/deploy/team-repositories/grant-maintainers-on-actions.yaml index 35cb057..36d19c4 100644 --- a/deploy/team-repositories/grant-maintainers-on-actions.yaml +++ b/deploy/team-repositories/grant-maintainers-on-actions.yaml @@ -11,6 +11,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: actions permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-aws.yaml b/deploy/team-repositories/grant-maintainers-on-aws.yaml index 9d4bca9..06570ea 100644 --- a/deploy/team-repositories/grant-maintainers-on-aws.yaml +++ b/deploy/team-repositories/grant-maintainers-on-aws.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: aws permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-doggy-countdown.yaml b/deploy/team-repositories/grant-maintainers-on-doggy-countdown.yaml index 491c3ad..f4e80c6 100644 --- a/deploy/team-repositories/grant-maintainers-on-doggy-countdown.yaml +++ b/deploy/team-repositories/grant-maintainers-on-doggy-countdown.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: doggy-countdown permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml b/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml index af00748..8b303d6 100644 --- a/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml +++ b/deploy/team-repositories/grant-maintainers-on-dotnet-template.yaml @@ -11,6 +11,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: dotnet-template permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-go-template.yaml b/deploy/team-repositories/grant-maintainers-on-go-template.yaml index 9383b1b..c3d19ea 100644 --- a/deploy/team-repositories/grant-maintainers-on-go-template.yaml +++ b/deploy/team-repositories/grant-maintainers-on-go-template.yaml @@ -11,6 +11,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: go-template permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml b/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml index d8a969c..73d2a39 100644 --- a/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml +++ b/deploy/team-repositories/grant-maintainers-on-homebrew-tap.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: homebrew-tap permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-ksail.yaml b/deploy/team-repositories/grant-maintainers-on-ksail.yaml index 0d013b6..b6095b2 100644 --- a/deploy/team-repositories/grant-maintainers-on-ksail.yaml +++ b/deploy/team-repositories/grant-maintainers-on-ksail.yaml @@ -11,6 +11,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: ksail permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml b/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml index 5a2529e..0b1f09c 100644 --- a/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml +++ b/deploy/team-repositories/grant-maintainers-on-kyverno-policies.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: kyverno-policies permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-monorepo.yaml b/deploy/team-repositories/grant-maintainers-on-monorepo.yaml index 18da786..8f831f3 100644 --- a/deploy/team-repositories/grant-maintainers-on-monorepo.yaml +++ b/deploy/team-repositories/grant-maintainers-on-monorepo.yaml @@ -11,6 +11,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: monorepo permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-platform-template.yaml b/deploy/team-repositories/grant-maintainers-on-platform-template.yaml index 2ee345c..226717d 100644 --- a/deploy/team-repositories/grant-maintainers-on-platform-template.yaml +++ b/deploy/team-repositories/grant-maintainers-on-platform-template.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: platform-template permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-platform-tenant-template.yaml b/deploy/team-repositories/grant-maintainers-on-platform-tenant-template.yaml index ccd0e0c..1d0377e 100644 --- a/deploy/team-repositories/grant-maintainers-on-platform-tenant-template.yaml +++ b/deploy/team-repositories/grant-maintainers-on-platform-tenant-template.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: platform-tenant-template permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-platform.yaml b/deploy/team-repositories/grant-maintainers-on-platform.yaml index af525dd..45ba7d1 100644 --- a/deploy/team-repositories/grant-maintainers-on-platform.yaml +++ b/deploy/team-repositories/grant-maintainers-on-platform.yaml @@ -11,6 +11,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: platform permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml b/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml index 7e8b57c..3e53996 100644 --- a/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml +++ b/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: provider-upjet-unifi permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-unifi.yaml b/deploy/team-repositories/grant-maintainers-on-unifi.yaml index b882046..bc8fa8f 100644 --- a/deploy/team-repositories/grant-maintainers-on-unifi.yaml +++ b/deploy/team-repositories/grant-maintainers-on-unifi.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: unifi permission: maintain providerConfigRef: diff --git a/deploy/team-repositories/grant-maintainers-on-world-at-ruin.yaml b/deploy/team-repositories/grant-maintainers-on-world-at-ruin.yaml index e79af75..01b9571 100644 --- a/deploy/team-repositories/grant-maintainers-on-world-at-ruin.yaml +++ b/deploy/team-repositories/grant-maintainers-on-world-at-ruin.yaml @@ -9,6 +9,8 @@ spec: forProvider: teamIdRef: name: maintainers + policy: + resolve: Always repository: world-at-ruin permission: maintain providerConfigRef: