fix(server): harden bundle vendor path against SSRF and resource exhaustion (NVIDIA#2170)

Signed-off-by: framsouza <fram.souza14@gmail.com>

Author: framsouza

docs/integrator/kubernetes-deployment.md

@@ -236,6 +236,10 @@ duplicated here.
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `PORT` | 8080 | HTTP server port |
+| `AICR_SERVER_ADDRESS` | (unset = all interfaces) | Listen address. Unset binds every interface (required for the in-tree Kubernetes Deployment: kubelet livenessProbe/readinessProbe and kube-proxy both dial the pod IP directly, not loopback). Set to `127.0.0.1` for a loopback-only bind on a sidecar or bare-host deployment fronted by a same-pod reverse proxy. Set to a specific interface to constrain listener binding. |
+| `AICR_ALLOW_VENDOR_CHARTS` | `false` | Opt-in for `POST /v1/bundle?vendor-charts=true`. When off (default) the vendor path is rejected with 400 — this endpoint drives server-side `helm pull` against a caller-supplied URL and must not be exposed on an unauthenticated network. Parsed by Go's `strconv.ParseBool`: accepts `1`/`t`/`T`/`TRUE`/`true`/`True` to enable (or the matching false values to disable); any other value (including `yes`, `on`, or a typo) is treated as disabled and logged as a warning. |
+| `AICR_HELM_REPOSITORY_HOST` | (unset = no credentials attached) | The single repository host the vendor-charts index pre-check may send `HELM_REPOSITORY_USERNAME`/`HELM_REPOSITORY_PASSWORD` to. Attaches credentials ONLY when: this env is set, the request scheme is `https`, and the request host case-insensitively matches this value. Any mismatch suppresses credentials silently so a caller-supplied `Repository` URL cannot exfiltrate the operator's helm credentials. Leave unset unless you need the index pre-check to authenticate against a specific private HTTP repo. |
+| `HELM_REPOSITORY_USERNAME` / `HELM_REPOSITORY_PASSWORD` | (unset) | Basic-auth credentials for the vendor-charts index pre-check. Gated by `AICR_HELM_REPOSITORY_HOST` above — no credentials fly unless that host allowlist is set. The upstream `helm pull --repo` subprocess does NOT itself consume these vars; private HTTP repos require an out-of-band `helm repo add --username --password` in the aicrd image. |
 | `SHUTDOWN_TIMEOUT_SECONDS` | 30 | Graceful-shutdown drain timeout (seconds) |
 | `AICR_LOG_LEVEL` | info | Logging level: debug, info, warn, error |
 | `AICR_ALLOWED_ACCELERATORS` | (unset = all) | Comma-separated allowlist of accelerator types (e.g. `h100,l40`) |
@@ -245,6 +249,57 @@ duplicated here.
 
 **Note:** These are the only environment variables the API server reads for criteria filtering and transport; server-side bundle signing (`POST /v1/bundle?attest=true`) reads an additional set documented in [API Reference › Server-Side Signing](../user/api-reference.md#server-side-signing). The four `AICR_ALLOWED_*` allowlists are parsed once at startup to restrict which criteria values the server will accept. Rate-limit, request-timeout, and body-size settings are compiled-in constants from `pkg/defaults`, not environment-tunable. The server uses structured JSON logging to stderr. The CLI supports three logging modes (CLI/Text/JSON), but the API server always uses JSON for consistent log aggregation.
 
+### Network Egress from the Vendor-Charts Path
+
+`POST /v1/bundle?vendor-charts=true` performs server-side `helm pull` against
+the repository URL declared by each component in the submitted recipe. Four
+controls keep this endpoint safe by default:
+
+1. **Opt-in gate.** Off unless the operator sets
+   `AICR_ALLOW_VENDOR_CHARTS=true`. The bundle handler rejects
+   `vendor-charts=true` with `400` when the server is not opted in, so an
+   accidentally-exposed instance never performs egress on behalf of a request.
+2. **Repository egress policy.** Even with opt-in, the vendor layer rejects
+   repository hosts that resolve to loopback, link-local, RFC1918 / CGNAT /
+   ULA private ranges, multicast, unspecified, or the well-known cloud-
+   metadata IPs (169.254.169.254, 100.100.100.200, fd00:ec2::254,
+   fe80::a9fe:a9fe).
+3. **Index-yaml pre-check (HTTP(S) only).** Before invoking `helm pull`, the
+   server fetches `<repo>/index.yaml` through a hardened HTTP client
+   (bounded body, redirect-hops validated against the same egress policy),
+   parses the entries for the requested chart+version, resolves relative
+   URLs, and rejects the request if ANY declared tarball URL points at a
+   disallowed host. This closes the classic "public index.yaml points at a
+   private-network tarball" SSRF vector at pre-check time.
+4. **Artifact size cap.** The pulled `.tgz` is capped at 64 MiB — well
+   above real charts, low enough to bound server memory.
+
+**Residual risks that require operator-side controls:**
+
+- **DNS rebinding** between the pre-check and helm's own re-resolution when
+  it actually fetches (helm re-resolves without exposing the resolved IP to
+  us).
+- **HTTP redirects during helm's tarball fetch** — helm is a subprocess and
+  its redirect hops are not visible to the pre-check.
+- **OCI protocol** — the OCI distribution redirect chain (manifest → blob
+  GETs, which registries commonly redirect to a CDN URL) is not intercepted.
+- **Resolver divergence** — the pre-check re-implements Helm's semver
+  constraint resolution to select which chart-version entry from the
+  fetched `index.yaml` to egress-check. Helm itself re-fetches the index
+  and re-resolves independently when it actually pulls, so the URL the
+  pre-check egress-validated can differ from the URL Helm pulls if the
+  index changes between calls or if the two resolvers pick differently
+  under ambiguous inputs — a defense-in-depth check that can bit-rot as
+  Helm evolves.
+
+For all four, the operational control is a Kubernetes `NetworkPolicy` on
+the aicrd pod or an equivalent egress firewall that allow-lists only the
+public chart registries the deployment needs. If you cannot enforce that
+network boundary, keep `AICR_ALLOW_VENDOR_CHARTS` off and front the server
+with authenticated ingress. A follow-up will move the tarball fetch
+in-process to close these residuals without needing a network-layer
+control.
+
 ### ConfigMap for Custom Recipe Data (Advanced)
 
 > **Note:** The `aicrd` HTTP server resolves recipes from the binary's

docs/user/api-reference.md

@@ -551,7 +551,7 @@ Generate deployment bundles from a recipe.
 | `accelerated-node-selector` | string[] | | Node selectors for GPU nodes (format: `key=value`). Repeat for multiple. |
 | `accelerated-node-toleration` | string[] | | Tolerations for GPU nodes (format: `key=value:effect`). Repeat for multiple. |
 | `nodes` | int | 0 | Estimated number of GPU nodes (0 = unset). Written to Helm value paths declared in the registry under `nodeScheduling.nodeCountPaths`. |
-| `vendor-charts` | bool | false | Pull upstream Helm chart bytes into the bundle at bundle time so the artifact is fully self-contained and air-gap deployable. Each vendored chart is recorded in `provenance.yaml` with name, version, source URL, and SHA256. Trades the upstream CVE-yank fail-loud signal for offline deployability — see the CLI reference's "Vendoring Charts for Air-Gap" section for the full tradeoff. Requires the `helm` binary on the API server's `$PATH` and registry credentials configured for any private upstream repos (`HELM_REPOSITORY_USERNAME`/`HELM_REPOSITORY_PASSWORD` for HTTP(S); docker config for OCI). If prerequisites are missing the request fails with a structured error code (`SERVICE_UNAVAILABLE` / HTTP 503 for missing helm, `UNAUTHORIZED` / HTTP 401 for credentials). |
+| `vendor-charts` | bool | false | Pull upstream Helm chart bytes into the bundle at bundle time so the artifact is fully self-contained and air-gap deployable. Each vendored chart is recorded in `provenance.yaml` with name, version, source URL, and SHA256. Trades the upstream CVE-yank fail-loud signal for offline deployability — see the CLI reference's "Vendoring Charts for Air-Gap" section for the full tradeoff. Requires the `helm` binary on the API server's `$PATH`. **The server-side vendor path is opt-in and off by default** — the operator must set `AICR_ALLOW_VENDOR_CHARTS=true`, otherwise `vendor-charts=true` returns `400 vendor-charts is not enabled on this server`. Even when enabled, repository hosts that resolve to loopback, link-local, private, or cloud-metadata IPs are rejected with `400 INVALID_REQUEST`, and vendored artifacts are capped at 64 MiB. **Private HTTP(S) repository credentials:** the aicrd pre-check sends `HELM_REPOSITORY_USERNAME`/`HELM_REPOSITORY_PASSWORD` (as HTTP Basic auth) ONLY when `AICR_HELM_REPOSITORY_HOST` is set to that repository's exact host, the request scheme is `https`, and the request host matches (case-insensitive). All three conditions must hold — an operator setting only the username/password env vars will get no credentials attached, preventing a caller-supplied `Repository` URL from harvesting the operator's helm credentials. (Note: the upstream `helm pull --repo` subprocess does not itself read these env vars — private HTTP repos require a prior `helm repo add --username --password` in the aicrd image or an SDK-based puller.) OCI credentials flow through the standard docker config (`~/.docker/config.json` or `$DOCKER_CONFIG`), exactly like `helm pull oci://...`. If prerequisites are missing the request fails with a structured error code (`SERVICE_UNAVAILABLE` / HTTP 503 for missing helm). The index pre-check surfaces upstream HTTP status by class: `404` → `NOT_FOUND` / HTTP 404, `401`/`403` → `UNAUTHORIZED` / HTTP 401, `408`/`429` → `SERVICE_UNAVAILABLE` / HTTP 503 (retryable), other `4xx` → `INVALID_REQUEST` / HTTP 400, `5xx` → `SERVICE_UNAVAILABLE` / HTTP 503. |
 | `serial` | bool | false | Sequence components strictly one at a time in deployment order, disabling the parallel rollout of independent components. Affects `deployer=argocd`, `argocd-helm`, `flux`, and `helmfile` (`helm` is already serial): argocd falls back to a linear sync-wave per folder, flux chains each `HelmRelease` `dependsOn` to the previous component, and helmfile chains every release via `needs:` into one linear apply order. An escape hatch for reproducing the pre-parallelism ordering or bisecting a rollout. |
 | `deployer` | string | helm | Deployment method: `helm`, `argocd`, `argocd-helm`, `flux`, or `helmfile` |
 | `repo` | string | | Git repository URL for GitOps deployments (used with `deployer=argocd` and `deployer=flux`; ignored by `deployer=argocd-helm`) |