A08: confirm the live cluster reconciles the cosign-verified OCIRepository #20

New issue

Closed

opened 2026-08-13 09:35:05 +00:00 by nalum · 1 comment

nalum commented

2026-08-13 09:35:05 +00:00

Owner

deploy/flux/ocirepository-lihnet.yaml:21-24 carries a cosign verify block. The local-ZOT variant (deploy/flux/ocirepository.yaml) has insecure: true, tag: latest, and no verify block. The kind cluster on the dev laptop is the production family install — if it reconciles the unverified ZOT source, anything that can push to zot:5000 in-cluster controls production deploys.

Fix

Check which OCIRepository the live cluster has applied.
If it is the ZOT one, either add a verify block or switch to the lihnet source.
Consider deleting the unsigned manifest or marking it dev-only in a way flux cannot pick up by accident.

Source: OWASP Top 10 (2025) audit of v1.1.0, 2026-08-13. File references point at the v1.1.0 tree.

`deploy/flux/ocirepository-lihnet.yaml:21-24` carries a cosign `verify` block. The local-ZOT variant (`deploy/flux/ocirepository.yaml`) has `insecure: true`, `tag: latest`, and **no** `verify` block. The kind cluster on the dev laptop is the production family install — if it reconciles the unverified ZOT source, anything that can push to `zot:5000` in-cluster controls production deploys. **Fix** - Check which OCIRepository the live cluster has applied. - If it is the ZOT one, either add a `verify` block or switch to the lihnet source. - Consider deleting the unsigned manifest or marking it dev-only in a way flux cannot pick up by accident. --- Source: OWASP Top 10 (2025) audit of `v1.1.0`, 2026-08-13. File references point at the `v1.1.0` tree.

nalum added this to the v1.1.0 security audit milestone

2026-08-13 09:35:05 +00:00

nalum added the

security

severity/low

labels

2026-08-13 09:35:05 +00:00

nalum added reference refs/tags/v1.1.0

2026-08-13 09:37:48 +00:00

nalum commented

2026-08-13 10:29:22 +00:00

Author

Owner

Verification result (2026-08-13): the live kind cluster runs no flux controllers at all — no flux CRDs exist, and the app deployment's image is digest-pinned from the local registry by make deploy (localhost:5000/...@sha256:c9e6344e...). Neither OCIRepository is reconciled, so the unsigned ZOT source is dormant, not a live path.

Residual risk was the manifest being applied by accident someday. The PR marks it DEV-ONLY in a loud header and points the family install at the verified lihnet variant.

🤖 Generated with Claude Code

**Verification result (2026-08-13):** the live kind cluster runs **no flux controllers at all** — no flux CRDs exist, and the app deployment's image is digest-pinned from the local registry by `make deploy` (`localhost:5000/...@sha256:c9e6344e...`). Neither OCIRepository is reconciled, so the unsigned ZOT source is dormant, not a live path. Residual risk was the manifest being applied by accident someday. The PR marks it DEV-ONLY in a loud header and points the family install at the verified lihnet variant. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

nalum referenced this issue from a pull request that will close it,

2026-08-13 10:29:23 +00:00

docs(deploy): mark the unsigned ZOT OCIRepository dev-only #33

nalum referenced this issue from a commit

2026-08-13 10:29:24 +00:00

docs(deploy): mark the unsigned ZOT OCIRepository dev-only

nalum referenced this issue from a commit

2026-08-13 11:25:40 +00:00

docs(deploy): mark the unsigned ZOT OCIRepository dev-only

nalum referenced this issue from a commit

2026-08-13 11:28:51 +00:00

docs(deploy): mark the unsigned ZOT OCIRepository dev-only