From 34f83cfbe6dd2760690b2213a5bc2fc252a46d49 Mon Sep 17 00:00:00 2001 From: "Calvin S." Date: Fri, 16 Oct 2026 16:51:33 -0700 Subject: [PATCH] docs(apiserver): document risk-acceptance for missing authn/TLS The AgentBaker apiserver registers HTTP handlers with only timeout and panic-recovery middleware - no JWT/mTLS/API-key check - and serves over plaintext HTTP (ListenAndServe, not ListenAndServeTLS). This is intentional and risk-accepted (By-Design), not an oversight: - Internal-only: this is a sidecar invoked solely by the AKS RP control plane over the cluster-internal network, never exposed publicly. - Boundary enforced elsewhere: the real security control is network isolation (pod/cluster network policy) configured in the RP deployment, outside this repo - not application-layer auth. - Low impact surface: handlers are stateless template generators that do not read tenant secrets from a backend store. - Real auth (mTLS/token-based) would require a cert/token issuance and rotation mechanism plus a coordinated change on the RP caller side (a different repo) - out of scope for a point fix here. Adds explanatory comments at NewRouter (middleware chain) and ListenAndServe (TLS) so the decision is discoverable in place and revisited if this service's network exposure ever changes. Addresses Mythos findings: ADO 37518917 (primary, CWE-306) and ADO 37518903 (duplicate of 37518917, CWE-306/CWE-319). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 350c2577-7031-4d0d-adc1-e99d053fc981 --- apiserver/apiserver.go | 5 +++++ apiserver/routers.go | 21 +++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/apiserver/apiserver.go b/apiserver/apiserver.go index fae2dded218..b0eb75d3e6b 100644 --- a/apiserver/apiserver.go +++ b/apiserver/apiserver.go @@ -97,6 +97,11 @@ func (api *APIServer) ListenAndServe(ctx context.Context) error { errors := make(chan error) go func() { + // Plaintext HTTP (not ListenAndServeTLS) is intentional here, risk-accepted + // By-Design - see the authn/authz rationale in NewRouter (routers.go). + // This server is only reachable from the AKS RP control plane over the + // cluster-internal network; TLS termination/authentication is handled at + // the network boundary, not in this process. errors <- svr.ListenAndServe() }() diff --git a/apiserver/routers.go b/apiserver/routers.go index e5d199f4f9f..fe68cda2605 100644 --- a/apiserver/routers.go +++ b/apiserver/routers.go @@ -43,6 +43,27 @@ func (api *APIServer) NewRouter() *mux.Router { router.Methods("GET").Path("/healthz").Name("healthz").HandlerFunc(healthz) // global timeout and panic handlers. + // + // No authentication middleware (JWT/mTLS/API-key) is intentionally added here; + // this is a risk-accepted By-Design decision, not an oversight. + // + // Rationale: + // - This APIServer is an internal sidecar invoked only by the AKS RP control + // plane over the cluster-internal network; it is not exposed to the public + // internet. + // - The enforced security boundary is network isolation (pod/cluster network + // policy), configured outside this repo in the RP deployment, not app-layer + // auth. + // - The handlers registered above are stateless template generators: they + // render node bootstrap data / image config from request input and do not + // read tenant secrets from a backend store. + // - Adding real authentication (mTLS or token-based) would require a + // cert/token issuance and rotation mechanism plus a coordinated change on + // the RP caller side (a different repo/system) - out of scope for a + // point fix here. + // + // If this router is ever exposed beyond the trusted RP-only network boundary, + // authentication middleware must be added here. router.Use(timeoutHandler(), recoveryHandler()) return router