Skip to content

Harden admission violation export: Dapr guard, recovery, and docs - #4782

Open
ShiyunXu wants to merge 3 commits into
open-policy-agent:masterfrom
ShiyunXu:admission-export-followups
Open

Harden admission violation export: Dapr guard, recovery, and docs#4782
ShiyunXu wants to merge 3 commits into
open-policy-agent:masterfrom
ShiyunXu:admission-export-followups

Conversation

@ShiyunXu

Copy link
Copy Markdown

Summary

Three focused, independent follow-ups to the webhook/admission violation export feature. Each commit is self-contained, compiles, and carries its own tests; the series bisects cleanly.

1. Reject admission violation export on the Dapr driver

Admission violation export relies on the disk driver's durable, bounded on-disk spool (record-size limits, rotation, retention, crash recovery). The Dapr driver provides none of these guarantees. The Helm chart already blocks enableAdmissionViolationExport unless exportBackend: disk, but raw-manifest deployments bypass that guard. This adds a runtime check in Dapr.Publish that rejects admission violation messages (across ExportMsg, *ExportMsg, and json.RawMessage shapes), surfaced through the existing export status, logs, and metrics.

2. Harden recoverAdmissionOpenFile

  • Guard against a non-positive maxBytes truncating away complete records.
  • Avoid clobbering an existing .recovered.log when the same base segment is recovered more than once (deterministic name first, random suffix as fallback).
  • Fix findLastNewline to scan only the bytes actually read (bytes.LastIndexByte(chunk[:n])) instead of the whole buffer converted from a possibly short read.

3. Document admission export record and disk limits

Expand the code comments and website/docs/export.md to explain what the 64 KiB complete-record limit measures (the full encoded record, including policy details and resource labels, not just the message), why it is well chosen, character-capacity guidance, and how it protects the bounded queue and spool. Also notes the new Dapr driver guard.

Testing

  • go build / go vet on pkg/export/... and pkg/webhook/...
  • go test -race for the Dapr publish guard, disk recovery, and webhook export packages
  • gofmt clean

Docs-only content in commit 3 (aside from the code comments) needs no test.

Admission violation export depends on the disk driver's durable, bounded spool. Reject admission violations in the Dapr driver so the restriction holds even under raw-manifest deployments that bypass the Helm guard.

Signed-off-by: ShiyunXu <ShiyunXu@users.noreply.github.com>
Guard against a non-positive maxBytes deleting complete records, avoid clobbering an existing .recovered.log on repeat recovery, and fix findLastNewline to scan only the bytes actually read.

Signed-off-by: ShiyunXu <ShiyunXu@users.noreply.github.com>
Explain why the 64 KiB complete-record limit is well chosen, what it measures, and how it protects the bounded queue and spool. Note the Dapr guard in the export docs.

Signed-off-by: ShiyunXu <ShiyunXu@users.noreply.github.com>
@ShiyunXu
ShiyunXu requested a review from a team as a code owner August 25, 2026 07:23
Copilot AI balanced review requested due to automatic review settings August 25, 2026 07:23
@linux-foundation-easycla

Copy link
Copy Markdown

CLA Not Signed

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Hardens admission violation export by restricting Dapr usage, improving disk recovery, and clarifying operational limits.

Changes:

  • Rejects admission violations sent through Dapr.
  • Preserves complete records during disk recovery and avoids deterministic filename collisions.
  • Expands tests and documentation for recovery and record-size limits.
Show a summary per file
File Description
website/docs/export.md Documents backend restrictions and record limits.
pkg/webhook/export.go Expands record-limit rationale.
pkg/export/disk/disk.go Clarifies disk record bounds.
pkg/export/disk/admission_file.go Hardens recovery and newline scanning.
pkg/export/disk/admission_file_test.go Tests recovery edge cases.
pkg/export/dapr/dapr.go Adds the Dapr admission guard.
pkg/export/dapr/dapr_test.go Tests supported payload shapes.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 7/7 changed files
  • Comments generated: 3
  • Review effort level: Balanced

Comment on lines +1045 to 1049
readyPath, err := recoveredReadyPath(path)
if err != nil {
return err
}
return os.Rename(path, readyPath)
Comment thread pkg/export/dapr/dapr.go
Comment on lines +68 to +73
case json.RawMessage:
var msg util.ExportMsg
if err := json.Unmarshal(value, &msg); err != nil {
return false
}
return msg.EventType == util.AdmissionViolationEventType
Comment thread website/docs/export.md
- the request identity (username, UID, and groups),
- and the JSON structure itself (field names, quotes, and escaping).

Because the limit is measured in bytes, the number of characters that fit depends on encoding. A 64 KiB record holds up to 65,536 bytes: roughly 65,000 plain ASCII characters, about half that for accented Latin or other two-byte UTF-8 text, and fewer still for three-byte (for example, CJK) or four-byte (for example, emoji) characters. Characters that must be JSON-escaped, such as `"`, `\`, and newlines, cost two bytes each.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants