Skip to content

Enforce the tenant ClusterIssuer boundary with an admission policy #2470

Description

@devantler

🤖 Generated by the Daily AI Assistant

Problem. cert-manager-tenant-edit (PR #2453) scopes tenants to namespaced Issuers, but RBAC cannot stop a tenant Certificate from referencing a cluster-scoped ClusterIssuer via spec.issuerRef.kind: ClusterIssuer — the reference is resolved by cert-manager's controller, not the tenant's identity. The stated boundary ("ClusterIssuer remains platform territory") is currently convention, not enforcement. Raised by review on #2453.

Proposed direction. Runtime-enforce per the fix-vs-except ladder: a Kyverno validating ClusterPolicy on Certificate (and CertificateRequest) objects in tenant namespaces rejecting spec.issuerRef.kind != Issuer — Kyverno is already the platform's admission layer, so prefer it over adding cert-manager approver-policy as a new controller. Start in Audit, graduate to Enforce.

Rough size. Small-medium: one ClusterPolicy + tenant-namespace selector convention + validation.

Activity

  1. coderabbitai commented on Jul 4, 2026

    @coderabbitai
    Contributor
    🔗 Related PRs

    #2316 - fix(kubescape): make ClusterSecurityException posture exceptions take effect [closed]
    #2343 - fix(openbao): grant external-secrets role write/read on apps/actual-budget path [closed]


    📝 Issue Planner

    Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.

    • Create Plan

    🧪 Issue enrichment is currently in open beta.

    You can configure auto-planning by selecting labels in the issue_enrichment configuration.

    To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

    issue_enrichment:
      auto_enrich:
        enabled: false

    💬 Have feedback or questions? Drop into our discord!

  2. moved this to 📥 Backlog in 🌊 Project Boardon Jul 18, 2026
  3. self-assigned this
    on Jul 28, 2026
  4. moved this from 📥 Backlog to 👀 In Review in 🌊 Project Boardon Jul 28, 2026
  5. moved this from 👀 In Review to 🏃🏻‍♂️ In Progress in 🌊 Project Boardon Jul 28, 2026
  6. moved this from 🏃🏻‍♂️ In Progress to ✅ Done in 🌊 Project Boardon Jul 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

No labels
No labels

Fields

No fields configured for Security.

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions