Validate Runtime/Builder Container SecurityContext
Committed by sanketsudake
fix(security): validate Runtime/Builder Container SecurityContext (#3406)
The round-4 PodSpec hardening (GHSA-gx55-f84r-v3r7 / GHSA-wmgg-3p4h-48x7 /
GHSA-v455-mv2v-5g92) validates and sanitizes dangerous fields on the
*PodSpec*, but the Environment CRD also exposes spec.runtime.container and
spec.builder.container — a standalone *corev1.Container merged into the
runtime/builder pod without going through any PodSpec. Its SecurityContext
was never inspected at admission, and the merge layer's
sanitizeContainerSecurityContext ran only inside MergePodSpec (never in
MergeContainer), so an Environment with
spec.runtime.container.securityContext.privileged=true was admitted and
yielded a privileged pool pod. Closes GHSA-m63v-2g9w-2w6v.
Admission (primary defence): extract ValidateContainerSafety(*Container)
from ValidatePodSpecSafety (no behaviour change for the PodSpec path) and
call it from Environment.Validate for Runtime.Container / Builder.Container.
Merge layer (defence in depth): sanitize the result of MergeContainer
unconditionally, covering the three call sites (poolmgr/gp_deployment,
newdeploy, buildermgr/envwatcher) so webhook-bypass clusters
(failurePolicy=Ignore or stale pre-webhook objects) are still protected.
sanitizeContainerSecurityContext already deep-copies before mutating, so
the informer-cached source container is not mutated.
Function needs no change: FunctionSpec has no standalone Container field;
its container-executor path goes through spec.podspec, already covered.
Co-authored-by: Claude Opus 4.7 <[email protected]>Editor assessment
This commit patches CVE-2026-50545, CVE-2026-50563, CVE-2026-50564 and CVE-2026-50566. The body establishes what earlier hardening missed: the round-four PodSpec work covered PodSpec fields, but Environment's standalone runtime and builder containers bypassed it and their SecurityContext was never inspected at admission. It then shows the consequence - privileged set to true yielding a privileged pool pod - and closes with the tracking advisory. The fix is primary admission validation extracted from ValidatePodSpecSafety without behavior change, plus defense in depth sanitizing MergeContainer output at three named call sites so webhook-bypass clusters stay protected. It notes the deep-copy guarantee and why functions need no change.