Repository navigation
docs: define Fluid security model and resource permissions - #6211
Conversation
Document who may configure and consume Fluid resources, with deployment guidance and vulnerability scope in English and Chinese. Signed-off-by: cheyang <cheyang.cy@alibaba-inc.com>
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #6211 +/- ##
=======================================
Coverage 65.60% 65.60%
=======================================
Files 486 486
Lines 34354 34354
=======================================
Hits 22539 22539
Misses 10061 10061
Partials 1754 1754 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
🟡 Changes recommended
The recommended multi-tenant model needs an explicit Runtime-network protection prerequisite to prevent direct connections from bypassing PVC access restrictions.
1 open finding
What changed in this PR
Adds English and Chinese security models defining Fluid resource permissions and deployment trust boundaries. This documentation-only change does not alter runtime behavior.
Changes:
- Defines administrator, consumer, and cache-operator permissions.
- Documents deployment scenarios, credential handling, and isolation limits.
- Provides RBAC examples, vulnerability scope, and verification guidance.
| File | Description |
|---|---|
| security/security-model.md | Defines the English security model and deployment guidance. |
| security/security-model_zh.md | Provides the corresponding Chinese security model. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| This model supports untrusted consumers through the default CSI `bindMount` | ||
| path, with administrator-provisioned data and restricted consumer Pods. The | ||
| administrator must also verify that configuration copied into consumer | ||
| namespaces contains no credentials or data beyond the intended grant (§6.2). |
cheyang
left a comment
cheyang
left a comment
There was a problem hiding this comment.
Both reviews treated this as what it is — a set of factual claims about the codebase — and verified them against the code instead of proofreading. Every cited path, symbol, constant and the CRD inventory resolve at this head; the RBAC claims hold against the rendered chart under both helmDriver settings, including the thinruntime-controller Secret detail and both webhooks' failurePolicy: Fail; EN and ZH are structurally identical with byte-identical YAML. CI is green — tide is just the merge queue waiting on labels. The diff is two new markdown files, so there is nothing to regress.
The residue is precision polish, none of it blocking: the local:// → hostPath conversion is JindoFSx/JindoCache-only, not "on Jindo" generally; spec.fuse.command/spec.fuse.args exist only on some runtime kinds but Section 3 states them as generic; nothing links to these docs from SECURITY.md, the README or the self-assessment, so the audience they are written for will not find them; the config/rbac role filenames use underscores where the doc writes dashes; Section 5 could mention the silent CSI node-authorization fallback; and of the three test areas Section 9 names, cross-namespace target rejection is the one still untested (a pre-existing gap). No disagreement survived cross-review — every finding was independently confirmed by the other reviewer. Copilot separately suggested that S2 should also require a Runtime-network boundary (Alluxio ships with permission checks disabled and its master Service exposing RPC); neither reviewer adopted it as required, but its factual basis checks out.
Next round
[MUST] (none — nothing blocks merge)
[SHOULD] Scope the local:// → hostPath claim to JindoFSx/JindoCache and spec.fuse.command/args to the runtime kinds that expose them (EN + ZH); add an inbound link from SECURITY.md and the self-assessment "Security links" table; fix the config/rbac glob spelling to underscores; optionally add one sentence on the CSI node-authorization fallback in Section 5.
[Filed] (none)
Non-blocking observations (7) — not part of this round's ask; fix now, follow up, or file an issue as you see fit
- security/security-model.md:104 — local:// mountPoint -> hostPath is JindoFSx/JindoCache-only, but the Tier-1 Dataset row says 'on Jindo' [minor]
- security/security-model.md:8 — The security model is undiscoverable: nothing links to it from SECURITY.md, README or the self-assessment [minor]
- security/security-model.md:57 — Section 3 cites spec.fuse.command / spec.fuse.args as generic; only some runtime kinds expose them [minor]
- security/security-model.md:580 — Cross-namespace target rejection in DataLoad/DataProcess has no direct unit test (pre-existing gap) [nit] — pre-existing, not introduced by this PR
- security/security-model.md:246 — Section 5 could mention the CSI node-authorization fallback when the kubelet config is missing [nit]
- security/security-model.md:147 — config/rbac role-file glob patterns use dashes; the real files use underscores [nit]
- security/security-model.md:291 — S2 could also require a Runtime-network boundary (Alluxio master RPC exposed, permission checks off by defa... [nit]
Verified review delta
- F1: open (initial-pr)
- F2: open (initial-pr)
- F3: open (initial-pr)
- F6: open (preexisting)
- F4: open (initial-pr)
- F5: open (initial-pr)
- C4291429070: open (initial-pr)
Code: clear. CI: success; attribution: baseline. Required CI checks still apply.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: TrafalgarZZZ The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Summary
Add a security model in English and Chinese that explains who may create, configure, and consume Fluid resources. Runtime and Dataset writes remain administrator-only; consumers use provisioned PVCs, and cache-operation delegation has explicit limits.
The documents describe trusted-team, administrator-provisioned multi-tenant, self-service, and sidecar deployments. They cover credential handling, reference Dataset authorization, CSI mount boundaries, PSA behavior, and vulnerability scope, with source references and RBAC examples.
This is a documentation-only change. It does not change permissions or runtime behavior and does not close an existing issue.
Test plan
Denyand the cache-operator role omits DataBackup writes.helmDriver=configmapandhelmDriver=secret; check wildcard-free RBAC, cluster-wide Secret permissions, and both injection webhooks' failure policies and selectors.git diff --checkand check the documented claims against the latest publicmaster.No implementation or test files are added. Local checks validate documentation consistency and chart rendering; they do not validate live PSA or CSI behavior. The verification section identifies the unit, fuzz, and integration coverage still needed for the stated boundaries.