make the ReferenceGrant source identity configurable and stop leaking selector matches - #14643
Open
puertomontt wants to merge 6 commits into
Open
puertomontt wants to merge 6 commits into
puertomontt wants to merge 6 commits into
Conversation
…aking selector matches Every cross-namespace reference in TrafficPolicySpec is evaluated against gateway.kgateway.dev/TrafficPolicy, whichever kind actually carries the spec being translated. When that is a different kind, the grant a user writes names the kind they created, the API server accepts it, and it never matches: the reference stays denied and nothing about the config changes. Add WithSourceGroupKind so the kind that holds the reference is the identity grants are evaluated against. It replaces the default rather than being ORed with it: from.kind scopes a grant to one referencing kind, and the kinds involved are typically creatable by different sets of users, so accepting either would hand out access the grant's author did not intend. It covers the references TrafficPolicySpec owns - basicAuth and apiKeyAuth secrets, secret-backed headerModifiers values, and extensionRef in Strict mode. Denials now report MissingReferenceGrantError, which names the namespace the grant belongs in and the identity it has to allow, instead of a bare "missing reference grant" that leaves the user guessing which kind to name. A denied label selector names neither the matched Secret nor its namespace: which secrets carry a label is not observable without a grant, so reporting one in policy status would let a referrer probe labels to learn that a Secret exists in a namespace that never granted it access. Signed-off-by: omar <omar.hammami@solo.io>
gateway-bot
added
kind/fix
… on backend refs GetSecretsBySelector matched labels across every namespace and then filtered by grant, so "missing reference grant" versus "no secrets found" still told a referrer whether a matching Secret existed in a namespace it had no access to. It now looks up the namespaces whose ReferenceGrants permit the referrer and searches only those plus its own, and returns a single SelectorNoMatchError naming the selector and the grant identity for every no-match outcome. BackendIndex.GetBackendFromRef returns MissingReferenceGrantError, so a denied GatewayExtension backend ref names the grant to create. Signed-off-by: omar <omar.hammami@solo.io>
puertomontt
marked this pull request as ready for review
September 23, 2026 16:56
puertomontt
changed the title
Contributor
There was a problem hiding this comment.
Copilot review overview
🔵 Needs a closer look
Preserve denied-reference classification and add constructor-level coverage for custom source identity wiring.
Review effort: Lite
Findings: None
What changed in this PR
Configures ReferenceGrant source identities for TrafficPolicy references and prevents selector errors from exposing inaccessible Secrets.
Changes:
- Adds
WithSourceGroupKindand propagates configurable identities. - Improves grant diagnostics and selector privacy.
- Updates tests, documentation, and expected outputs.
| File | Summary |
|---|---|
pkg/plugins/gwextbase/base.go |
Exposes constructor options. |
pkg/krtcollections/secrets.go |
Implements grant-scoped selector lookup and safe errors. |
pkg/krtcollections/refgrant_source_test.go |
Tests source identity and selector privacy. |
pkg/krtcollections/policy.go |
Adds descriptive grant errors and namespace indexing. |
pkg/krtcollections/configmaps.go |
Uses descriptive grant errors. |
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/ratelimit-cross-namespace.yaml |
Updates expected output. |
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/header-modifiers-from-secret-cross-namespace-no-refgrant.yaml |
Updates expected output. |
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/extproc-cross-namespace.yaml |
Updates expected output. |
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/extauth-cross-namespace.yaml |
Updates expected output. |
pkg/kgateway/translator/gateway/testutils/outputs/traffic-policy/api-key-auth-selector-no-matching-secret.yaml |
Updates selector error output. |
pkg/kgateway/translator/gateway/testutils/outputs/reference-grant-mode/strict-extensionref-no-grant.yaml |
Updates expected grant error. |
pkg/kgateway/translator/gateway/testutils/outputs/jwt/cross-namespace.yaml |
Updates expected output. |
pkg/kgateway/extensions2/plugins/trafficpolicy/header_modifiers.go |
Propagates source identity. |
pkg/kgateway/extensions2/plugins/trafficpolicy/constructor.go |
Adds configurable source identity support. |
pkg/kgateway/extensions2/plugins/trafficpolicy/basic_auth_policy.go |
Applies configurable grant identity. |
pkg/kgateway/extensions2/plugins/trafficpolicy/api_key_auth.go |
Applies configurable grant identity. |
devel/reference_grant/reference-grant-mode.md |
Documents the new behavior. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
The uniform SelectorNoMatchError is what stops a selector revealing matches in ungranted namespaces; searching only granting namespaces was an optimization on top. Match across all secrets and filter by grant as before, and drop the source-keyed grant index and per-namespace secret index it needed. Signed-off-by: omar <omar.hammami@solo.io>
Naming the grant identity in ReferenceGrant errors is left for a follow-up, so drop MissingReferenceGrantError and SelectorNoMatchError and restore the original messages. The selector keeps the fix for the leak: a match skipped for a missing grant no longer returns ErrMissingReferenceGrant, so it reads the same as no match at all. Signed-off-by: omar <omar.hammami@solo.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
WithSourceGroupKind(gk)sets the identity ReferenceGrants are evaluated against for thereferences
TrafficPolicySpecowns:basicAuth.secretRef,apiKeyAuth.secretRef,apiKeyAuth.secretSelector, secret-backedheaderModifiersvalues, andextensionRefinStrict mode. It defaults to
TrafficPolicyand is exposed throughpkg/plugins/gwextbase.The identity replaces the default rather than being ORed with it:
from.kindscopes agrant to one referencing kind.
MissingReferenceGrantError, naming the namespace the grant belongs in andthe identity it has to allow, so the grant to write is readable off the policy status.
source identity is still
TrafficPolicy, and the same references are permitted and denied asbefore. Only the message text changes.
Change Type
/kind fix
Changelog