openshift-ci-robot
commented
4 days ago @jhadvig: This pull request references CONSOLE-4265 which is a valid jira issue.
Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.18.0" version, but no target version was set.
In response to [this](https://github.com/openshift/api/pull/2042):
>When serving Console HTML index page, we generate the policy that includes allowed (trustworthy) [sources](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources).
>It may be necessary for some dynamic plugins to add new sources in order to avoid CSP violations at Console runtime.
>We need to extend the ConsolePlugin CRD, in order to give the plugin creators a mechanism how to specify these source.
>
>We discussed with @vojtechszocs two possible implementation:
>1. Add a new field to spec for specifying an array of sources which would apply for all the CSP directives - `spec.csp.allowedSources`. This implementation is pretty straight-forward but automatically applying the same source across different directives could unintentionally block legitimate content or reduce security.
>
> Example:
>```yaml
>kind: ConsolePlugin
>metadata:
> name: my-console-plugin
>spec:
> displayName: "My Custom Console Plugin"
> backend:
> service:
> name: "plugin-backend-service"
> namespace: "plugin-namespace"
> port: 8080
> csp:
> allowedSources:
> - "self"
> - "https://trusted-images.com"
> - "https://cdn.images.com"
>```
>
>2. (Proposed solution) Add a new field to spec for specifying an array of sources for each of the directives. Letting users manage different whitelists for different types of content, gives them more flexibility in controlling security settings.
>
> Example:
>```yaml
>kind: ConsolePlugin
>metadata:
> name: my-console-plugin
>spec:
> displayName: "My Custom Console Plugin"
> backend:
> service:
> name: "plugin-backend-service"
> namespace: "plugin-namespace"
> port: 8080
> csp:
> - directive: script-src
> sources:
> - "self"
> - "https://trusted-scripts.com"
> - directive: img-src
> sources:
> - "self"
> - "https://trusted-images.com"
> - "https://cdn.images.com"
> - directive: style-src
> sources:
> - "self"
> - "https://trusted-styles.com"
>```
>
>Note: The PR is missing some descriptions and validation and unit tests. Will address those once we align on the API structure.
>
>/assign @spadgett @vojtechszocs
>
>Story: https://issues.redhat.com/browse/CONSOLE-4265
>
>
Instructions for interacting with me using PR comments are available [here](https://prow.ci.openshift.org/command-help?repo=openshift%2Fapi). If you have questions or suggestions related to my behavior, please file an issue against the [openshift-eng/jira-lifecycle-plugin](https://github.com/openshift-eng/jira-lifecycle-plugin/issues/new) repository.
openshift-ci[bot]
jhadvig
When serving Console HTML index page, we generate the policy that includes allowed (trustworthy) sources. It may be necessary for some dynamic plugins to add new sources in order to avoid CSP violations at Console runtime. We need to extend the ConsolePlugin CRD, in order to give the plugin creators a mechanism how to specify these source.
We discussed with @vojtechszocs two possible implementation:
Add a new field to spec for specifying an array of sources which would apply for all the CSP directives -
spec.csp.allowedSources. This implementation is pretty straight-forward but automatically applying the same source across different directives could unintentionally block legitimate content or reduce security.Example:
(Proposed solution) Add a new field to spec for specifying an array of sources for each of the directives. Letting users manage different whitelists for different types of content, gives them more flexibility in controlling security settings.
Example:
Note: The PR is missing some descriptions and validation and unit tests. Will address those once we align on the API structure.
/assign @spadgett @vojtechszocs
Story: https://issues.redhat.com/browse/CONSOLE-4265