feat: dedicated least-privilege replication ACL user - #34
Merged
Conversation
Replicas authenticated to their primary as the full-access `default` user (masterauth only). Seed a dedicated `replicator` ACL user instead — granting just `+psync +replconf +ping` with no key access — and point replicas at it via `masteruser`. A leaked replication credential can now do nothing but replicate, not read or write your data. It mirrors the Sentinel user (S1) and the upstream community operator's dedicated replication user. Seeded in users.acl for every replicating topology (Replication, Cluster, Sentinel); Standalone has no replica link and gets neither the user nor masteruser. The operator's own control connections keep using the default user. Two safety issues a cross-model (Grok) review surfaced are fixed here: - Password rotation now re-keys the managed non-default users (replicator, and the Sentinel user) alongside default, additive-then-cutover. Without this, masteruser=replicator would WRONGPASS the moment a live rotation dropped the old password — a regression this change would otherwise introduce, and a pre-existing gap for the Sentinel user. - `replicator` and `sentinel-user` are reserved: the ValkeyACL webhook rejects them and the reconciler never DELUSERs them, so a user-defined ACL can't wipe the credential the operator depends on. Verified live on a dedicated k3d cluster (a Replication cluster's replicas link as replicator, master_link_status:up, data replicates, no NOPERM) and with a Docker harness for the rotation sequence (after a full add-new + cutover rotation, a forced replica re-handshake re-authenticates as replicator under the new password with no WRONGPASS). Unit tests cover the render/seed/masteruser scoping, the reserved-name webhook rejections, and the managed-user set. Full envtest + lint clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replicas authenticated to their primary as the full-access
defaultuser (masterauth only). This adds a dedicatedreplicatorACL user granting only+psync +replconf +pingwith no key access, and points replicas at it viamasteruser. A leaked replication credential can now do nothing but replicate, not read or write your data. It mirrors the Sentinel user (S1) and the upstream community operator's dedicated replication user.The user is seeded in
users.aclfor every replicating topology (Replication, Cluster, Sentinel). Standalone has no replica link and gets neither the user normasteruser. The operator's own control connections keep using the default user, so nothing about failover, survey, or the ValkeyACL reconciler changes.Two safety issues a cross-model (Grok) review surfaced, fixed here
default, additive-then-cutover. Without it,masteruser=replicatorwould WRONGPASS the moment a live rotation dropped the old password. That is a regression this change would otherwise introduce, and it was already a latent gap for the Sentinel user.replicatorandsentinel-userare reserved: the ValkeyACL webhook rejects them and the reconciler never DELUSERs them, so a user-defined ACL cannot wipe the credential the operator depends on.Verification
replicator,master_link_status:up, data replicates, no NOPERM in the logs.replicatorunder the new password with no WRONGPASS.masteruserscoping (all topologies plus a Standalone negative and a no-key-glob assertion), the reserved-name webhook rejections, and the managed-user set.make lintare clean.