chisel-operator icon indicating copy to clipboard operation
chisel-operator copied to clipboard

Cross-namespace ExitNodeProvisioner selection inside LB service still tries to find ENP in same namespace as the service itself

Open korewaChino opened this issue 11 months ago • 0 comments

If the service's provisioner selection is namespace/provisioner, the ExitNode deployed will be in the service's namespace, but unprovisionable because it's not namespace/provisioner too, and the provisioner is not in the same namespace

How to reproduce

  1. Create ENP object in a namespace, e.g foo named baz
  2. Create another LoadBalancer Service in namespace bar, with annotation pointing to foo/baz, AKA ENP foo in baz

Expected result

ExitNode should be inside bar, but annotation should point to foo/baz. Instead it points to just baz, but we don't have bar/baz as an ENP

This may also allow someone to hijack an Exit Node's ENP by simply creating a new ENP at bar/baz

korewaChino avatar Mar 10 '24 09:03 korewaChino