mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
joshsiv-mulga
a23e1ccf59
WebhookTokenReview took its account from the request body and was authorised by IAM policy alone, with the control-plane role granting it on "*". A control-plane VM, any tenant holding eks:*, or static system credentials could resolve a token against another cluster or account and learn the Kubernetes groups it maps to there. Error responses also distinguished absent accounts from absent clusters. WebhookTokenReview now passes the same internal-route gate as PublishInternal: a control-plane instance-role session that is a member of the URL cluster in the body account. The gate and the handler share one body decoder, each body-scoped internal route must declare its reader, and every unauthorised target returns the same AccessDenied without reaching STS verification. Same-cluster responses are unchanged.