P0: Block ClusterGateway transport until upstream strips inbound Authorization before MSA proxying

[gnanirahulnutakki]

Security blocker

Slice #103 cannot ship against ClusterGateway v1.3.1, v1.3.2, or v1.4.0. Its proxy handler clones the incoming hub request headers, including Authorization, before creating a transport from the registered managed-service-account credential. The Kubernetes bearer wrapper preserves an existing authorization header, so a hub caller credential reaches the managed-cluster API instead of the scoped MSA.

Reproduction

The retained M0 hub-plus-two-spoke lab proves the gateway MSA can list only sith-demo Pods and is denied Secrets. A Sith hub reader with only get on clustergateways/proxy nevertheless receives HTTP 200 from the pinned gateway Secrets route. The test is now privacy-safe and does not print response bodies. Disabling the pinned cluster-proxy chart impersonation flag does not change this result.

Required resolution

• Upstream must remove or replace inbound Authorization before proxying with the selected MSA credential.
• Add upstream regression coverage for caller header precedence and a real managed-cluster RBAC denial.
• Revalidate with Sith M0 two-spoke integration before reopening P1: Implement pinned OCM ClusterGateway snapshot transport #103.

Scope

No Sith transport is merged while this remains unresolved. This issue does not contain credentials, response bodies, or cluster data.

[gnanirahulnutakki]

2026-07-12 upstream freshness review:

• The exact upstream is oam-dev/cluster-gateway. Its newest release is v1.9.1 (2025-05-16); master remains the default branch.
• v1.4.0, v1.9.1, and current master all retain the unsafe sequence in pkg/apis/cluster/v1alpha1/clustergateway_proxy.go: clone inbound request headers, then create restclient.TransportFor(cfg) from the managed credential. None removes or replaces inbound Authorization before the proxy serves the request.
• Upstream issues and PRs contain no matching authorization-header / MSA-precedence remediation or regression test. A version bump cannot safely unblock Sith.

No Sith transport or M0 control was changed. #103 remains blocked until upstream ships an authorization-isolation fix with header-precedence and real scoped-RBAC-denial coverage; then we must rerun the two-spoke M0 negative test and require HTTP 403 for the fixed Secrets route.

[gnanirahulnutakki]

Upstream engagement is now in progress under oam-dev/cluster-gateway#170 and PR #171.

The PR removes inbound Authorization before the selected ClusterGateway credential transport and adds a TLS-backed header-precedence regression. Local focused, full-package envtest, race, make test, make, and regular kind proxy gates passed. The local OCM add-on harness reached the APIService but failed before a proxy assertion with an HTTP/2 internal-stream 503; upstream hosted OCM CI is running.

#103 remains blocked until the upstream PR is merged/released and Sith reruns the M0 two-spoke negative test requiring 403 for the fixed Secrets route.

[gnanirahulnutakki]

Update: upstream remediation is now submitted as oam-dev/cluster-gateway#171, which fixes the proxy header precedence and is mergeable. Its exact signed commit 5bd9423 passed all hosted gates: unit tests, standard ClusterGateway end-to-end, and OCM add-on end-to-end.

#103 and this blocker remain open: Sith must consume an official upstream release and rerun the two-spoke M0 test to demonstrate an authorization-negative 403 response without response-body logging.

[gnanirahulnutakki]

2026-07-13 monitor evidence:

• Sith security queues are clear: Dependabot 0, code scanning 0, secret scanning 0.
• The official oam-dev/cluster-gateway latest release remains v1.9.1 (2025-05-16); current master remains 2b04dd452b7a9da6e75de105cd00499a1c6369bd and has not incorporated the authorization-isolation remediation.
• Upstream #171 is still open and mergeable at signed 5bd9423337eee6bdf10fc29041dcb0e77a7eae21, with green unit, gateway e2e, OCM add-on e2e, and DCO checks. It is not an official release artifact.

Sith PR #121 records the release-consumption gate and hardens the local build/release checks. #103 remains blocked: consume an official release first, then rerun the two-spoke M0 negative route and require a scoped 403 without logging credentials or response bodies.

[gnanirahulnutakki]

2026-07-14 upstream/security refresh:

• Official oam-dev/cluster-gateway latest release remains v1.9.1, published 2025-05-16.
• Current upstream master remains 2b04dd452b7a9da6e75de105cd00499a1c6369bd (2025-06-29) and does not contain the remediation.
• Upstream PR #171 remains open/unmerged at 5bd9423; all hosted checks (unit, ClusterGateway e2e, OCM-addon e2e, DCO, coverage, reviewer) are green, but it is not an official release artifact.

The release-consumption gate therefore still holds: do not reopen Sith #103 or consume an unreleased upstream patch. After a released fix, rerun the retained two-spoke M0 negative route and require scoped 403 for the Secrets request without logging credential or response material. Sith security queues remain 0/0/0.