Repository navigation
DR identity allow-list is satisfied by a comment, so the gate can certify an allow-list that is not in effect #2945
Description
🤖 Generated by the Agentic Engineer
Evidence
validate-dr-signing decides whether the DR rebuild identity is allowed by scanning the cluster config as raw text (containsLine), so any line containing the subject regex satisfies it — including a comment.
Measured 2026-08-04 against ksail.prod.yaml, changing only where the identity appears:
| config | validator |
|---|---|
DR matcher present in matchOIDCIdentity (real) |
contract passed, exit 0 |
| DR matcher removed | does not allow the DR rebuild identity, exit 1 |
DR matcher removed, identical regex added as a # comment |
contract passed, exit 0 |
The middle row is the positive control: the check does fire when the identity is genuinely absent. The third row is the bypass — a comment has no effect on the cluster, and the gate accepts it.
A second, related shape: the same text scan passes when the whole verify block sits at a path KSail discards. validate-dr-signing reported contract passed on a config reproducing the #2627 outage exactly.
Problem
The DR contract exists so a disaster-recovery rebuild cannot publish an artifact production will refuse — the one failure that is unrecoverable by hand, discovered mid-incident. A check satisfied by inert text certifies an allow-list that may not be in effect.
The second shape is largely covered once #2920's read-path check runs in the same job, but the comment bypass is not: that check confirms the block resolves, not that this identity is inside it.
Expected
The DR identity is asserted against the parsed matchOIDCIdentity entries at the path KSail reads, not against the file's text.
Direction
Parse the config (the repo already depends on gopkg.in/yaml.v3) and compare spec.workload.flux.verify.matchOIDCIdentity[].subject values exactly, rather than substring-matching lines. This is the same "parse, don't scan" correction validateCDWiring already documents for workflows — its four enumerated scan defeats are the same class as this one, so the reasoning is already settled in-repo and only the config half was left scanning.
Worth auditing the other containsLine/lineIndexContaining call sites in that file while there, since they share the primitive.
Acceptance criteria
- The identity in a comment fails the check
- The identity at a path KSail does not read fails the check
- The check still passes on the real
ksail.prod.yaml - Ablation recorded: each new arm is shown to fail on the broken input, with a control that stays green
Part of #2627. Size: S.
Metadata
Metadata
Assignees
Labels
Type
Fields
Projects
- Status
Activity
coderabbitai commentedon Aug 4, 2026
🔗 Related PRs
#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [merged]
#2404 - fix: tenant artifact verification rejects the dual signing identities from
#2399[merged]#2408 - fix(rgd): single regex-alternated cosign identity for tenant artifact verification [merged]
#2816 - fix(security): reject floating workflow refs in cosign subject matchers [merged]
#2919 - fix(security): move Flux cosign verify to the path KSail reads [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!