feat(mealie): stage GitOps application access canary #180

Merged

morten-olsen merged 4 commits from feat/homeit-474-mealie-access into main

2026-10-29 23:06:24 +01:00

morten-olsen commented

2026-10-29 22:52:48 +01:00

Owner

Summary

Migrate Mealie to the GitOps group model as the first application canary. Its client allows its own empty-membership prod/mealie group OR shared/admin; the central administrator group is already live and verified with only existing morten. No Authentik superuser bypass or application administrator role is added.

The chart uses published common 0.2.0. Enrollment assertions run at the rendered-object seam in normal CI; the acceptance script accepts selected app names for staged rollout. Remaining application migrations stay outside this PR.

Evidence

Operator 0.2.0 is live at approved image index sha256:4dbc36625fbb5ea76e78b0005131ac0cb623a5e04a6b830825b9eca953d19bf1, one Ready replica, zero restarts. Core/shared are Synced/Healthy at 8e441bb; core main build #183 and chart publication 40960494980 succeeded.
shared/admin Ready at generation 1; backing group gitops/shared/admin has matching CR UID, exactly user 7 with the pinned UUID, is_superuser=false, no roles/parent/children. Existing users/groups/applications/bindings compare unchanged across operator rollout. All 17 legacy clients remain Ready/LegacyAccessUnmanaged.
Actual published dependency build, Mealie lint/render/kubeconform and existing claim-mapping tests pass. Selected-app enrollment check passed after reproducing/fixing its earlier assumption that all 17 charts were already migrated. Full Mealie chart passes server dry-run including the new group and changed client; inherited duplicate-TZ warning remains.
Before/after rendered specs show only AuthentikClient.allowedGroups and the new AuthentikGroup change. Mealie pod template is identical; image, volumes, redirects, scopes, verified-email requirements and internal role settings remain unchanged.
Current Authentik inventory: no existing binding targets the Mealie application. Repeat immediately before cutover; unknown/permissive bindings require explicit investigation/replacement approval.

Merge danger

Door: one-way access-policy cutover. Once managed, omitting allowedGroups denies access; a chart revert does not restore legacy allow-all. Do not merge until Security review and Morten's staged cutover decision are recorded. This repository has no release-publishing workflow; merging reaches ArgoCD automatically.

Blast radius: Mealie new authorization attempts. Existing application sessions/tokens retain their own lifetimes. The app group starts empty, so initial access is through shared/admin only. Other applications remain legacy until their own reviewed migration.

Rollback and verification

Preserve the verified administrator group and fail-closed guard. Resolve a bad/missing reference through Git and verify exact bindings/provider attachment before continuing; do not downgrade the controller, erase ownership or restore allow-all as a workaround. Pause subsequent applications if the canary fails; any recovery accepting wider access needs Morten's decision.

After merge, follow the CI pipeline, Forgejo mirror, Argo revision, exact group ownership/membership and native ANY bindings plus permanent false guard. Prove fresh Authentik authorization as administrator, unrelated existing user denial, app-only grant/removal through Git, and fail-closed/restart stability under the agreed plan. No new users/passwords or email-trust changes are included. Mealie's existing mealie-users login gate and morten-only verified-email mapping are distinct from IdP authorization: report completed Mealie login/session evidence separately and do not claim an OAuth code proves it.

Security review covers this concrete activation diff and the base staged plan (docs/authentik-group-cutover.md, HOMEIT-474); Software Engineer retains merge, rollout and acceptance ownership.

## Summary Migrate Mealie to the GitOps group model as the first application canary. Its client allows its own empty-membership `prod/mealie` group OR `shared/admin`; the central administrator group is already live and verified with only existing morten. No Authentik superuser bypass or application administrator role is added. The chart uses published common 0.2.0. Enrollment assertions run at the rendered-object seam in normal CI; the acceptance script accepts selected app names for staged rollout. Remaining application migrations stay outside this PR. ## Evidence - Operator 0.2.0 is live at approved image index `sha256:4dbc36625fbb5ea76e78b0005131ac0cb623a5e04a6b830825b9eca953d19bf1`, one Ready replica, zero restarts. Core/shared are Synced/Healthy at `8e441bb`; core main build #183 and chart publication 40960494980 succeeded. - `shared/admin` Ready at generation 1; backing group `gitops/shared/admin` has matching CR UID, exactly user 7 with the pinned UUID, `is_superuser=false`, no roles/parent/children. Existing users/groups/applications/bindings compare unchanged across operator rollout. All 17 legacy clients remain Ready/LegacyAccessUnmanaged. - Actual published dependency build, Mealie lint/render/kubeconform and existing claim-mapping tests pass. Selected-app enrollment check passed after reproducing/fixing its earlier assumption that all 17 charts were already migrated. Full Mealie chart passes server dry-run including the new group and changed client; inherited duplicate-TZ warning remains. - Before/after rendered specs show only AuthentikClient.allowedGroups and the new AuthentikGroup change. Mealie pod template is identical; image, volumes, redirects, scopes, verified-email requirements and internal role settings remain unchanged. - Current Authentik inventory: no existing binding targets the Mealie application. Repeat immediately before cutover; unknown/permissive bindings require explicit investigation/replacement approval. ## Merge danger **Door:** one-way access-policy cutover. Once managed, omitting allowedGroups denies access; a chart revert does not restore legacy allow-all. Do not merge until Security review and Morten's staged cutover decision are recorded. This repository has no release-publishing workflow; merging reaches ArgoCD automatically. **Blast radius:** Mealie new authorization attempts. Existing application sessions/tokens retain their own lifetimes. The app group starts empty, so initial access is through shared/admin only. Other applications remain legacy until their own reviewed migration. ## Rollback and verification Preserve the verified administrator group and fail-closed guard. Resolve a bad/missing reference through Git and verify exact bindings/provider attachment before continuing; do not downgrade the controller, erase ownership or restore allow-all as a workaround. Pause subsequent applications if the canary fails; any recovery accepting wider access needs Morten's decision. After merge, follow the CI pipeline, Forgejo mirror, Argo revision, exact group ownership/membership and native ANY bindings plus permanent false guard. Prove fresh Authentik authorization as administrator, unrelated existing user denial, app-only grant/removal through Git, and fail-closed/restart stability under the agreed plan. No new users/passwords or email-trust changes are included. Mealie's existing `mealie-users` login gate and morten-only verified-email mapping are distinct from IdP authorization: report completed Mealie login/session evidence separately and do not claim an OAuth code proves it. Security review covers this concrete activation diff and the base staged plan (`docs/authentik-group-cutover.md`, HOMEIT-474); Software Engineer retains merge, rollout and acceptance ownership.

morten-olsen added 4 commits

2026-10-29 22:52:48 +01:00

test: verify rendered GitOps application access groups 2e67cb8249

feat(mealie): declare GitOps application access 96d4c25d72

Merge remote-tracking branch 'origin/main' into feat/homeit-474-mealie-access 2d48a6212c

test: support application-by-application OIDC checks

ci/woodpecker/pr/charts Pipeline was successful

Details

ci/woodpecker/push/scan Pipeline was successful

Details

c8270817d2

morten-olsen reviewed

2026-10-29 22:58:38 +01:00

morten-olsen left a comment

Security review of c8270817d2 against 2d35b01; concrete Mealie activation only. Read base #66 at 403f447, cutover plan and stage-1 evidence, apps standards, full diff and published library render. Standards No blocking finding. Published common 0.2.0 SHA-256 is 19cbf5f2e92b4edf63d5fcfb9901938f3bf1fac9e8cb304e1535ba3f854e2d78, matching stage-1 evidence. Render has exactly prod/mealie members=[] plus allowedGroups=[prod/mealie,shared/admin] on the same shared/authentik server. No privilege/hierarchy fields, second membership writer, new image source, RBAC, host access, exposure or secret payload changes. Before/after render comparison found only the new group and client allowedGroups spec changes; Mealie pod template is identical. Existing scopes, redirect, signup, login/admin group settings and verified-email mapping remain intact. Compromise gains no new workload privilege from this diff; public Mealie's existing application/data exposure remains. Non-blocking LOW: handoff's pipeline URL has the wrong repository ID. Authoritative Forgejo commit status confirms SUCCESS #462 at https://woodpecker.olsen.cloud/repos/3/pipeline/462/1. woodpecker-cli exists here but is unconfigured; no pipeline logs independently checked. Spec No blocking finding in the activation or staged plan. It preserves additive group references and uses the established operator ownership/fail-closed contract without re-reviewing operator source. Plan requires exact UID/member/privilege/binding readback, fresh morten allow and unrelated superuser deny, Git membership grant/removal, drift/restart/error recovery and retained group identity. Approved temporary tests must stay on the canary; do not alter shared/admin or unmanaged groups. No provisioning, password or email-trust change is authorized. Non-blocking UNKNOWN (acceptance pending): actual fresh OAuth authorization is unverified. This is a prerequisite to advancing beyond the canary, not evidence of an exploit or a review waiver. Use authorized existing account contexts; audited impersonation only if available/authorized. Keep cookies, codes, tokens and credentials in memory and out of output. A code issuance proves IdP authorization only; report Mealie's separate login/verified-email gates and existing sessions/token lifetimes independently. If contexts are unavailable, stop and request that prerequisite. Verification: locally lint, selected-app enrollment assertions and seven verified-email tests pass with the hash-verified published package. Local Helm 4.3 dependency resolution failed despite the public index containing 0.2.0; direct published package download enabled render validation. kubeconform unavailable locally; server dry-run is author's evidence. Live kubectl get applications -n argocd confirms core/shared 8e441bb and authentik 0.2.0 Synced/Healthy; Mealie remains 2d35b01 Synced/Healthy. Pod read confirms operator digest 4dbc3662... Ready, zero restarts. AuthentikClient/Group reads are Forbidden under this role, so exact remote membership/bindings remain stage-1 supplied evidence. Software Engineer must repeat kubectl get authentikclients -A -o json and kubectl get authentikgroups -A -o json plus sanitized Authentik API application/binding/group inventory before cutover; omit Secret/ConfigMap payloads and all credentials/tokens. Keep unmerged until Morten's staged cutover decision. After approval, verify mirror/Argo exact revision, current Ready/AccessReady and actual fresh authorization including grant/removal and fail-closed cases before another app. Stop on failure, close/disconnect affected application, restore reviewed access through GitOps; chart revert alone does not restore remote bindings/memberships or revoke sessions. Do not downgrade operator or delete/adopt retained identities as automatic rollback. Standards: 1 non-blocking LOW; Spec: 1 non-blocking UNKNOWN. No blocking code finding; cutover approval and actual acceptance remain separate gates.

Security review of c8270817d24a1fa31edadc5bfe67b0af0221429e against 2d35b01; concrete Mealie activation only. Read base #66 at 403f447, cutover plan and stage-1 evidence, apps standards, full diff and published library render. Standards No blocking finding. Published common 0.2.0 SHA-256 is 19cbf5f2e92b4edf63d5fcfb9901938f3bf1fac9e8cb304e1535ba3f854e2d78, matching stage-1 evidence. Render has exactly prod/mealie members=[] plus allowedGroups=[prod/mealie,shared/admin] on the same shared/authentik server. No privilege/hierarchy fields, second membership writer, new image source, RBAC, host access, exposure or secret payload changes. Before/after render comparison found only the new group and client allowedGroups spec changes; Mealie pod template is identical. Existing scopes, redirect, signup, login/admin group settings and verified-email mapping remain intact. Compromise gains no new workload privilege from this diff; public Mealie's existing application/data exposure remains. Non-blocking LOW: handoff's pipeline URL has the wrong repository ID. Authoritative Forgejo commit status confirms SUCCESS #462 at https://woodpecker.olsen.cloud/repos/3/pipeline/462/1. woodpecker-cli exists here but is unconfigured; no pipeline logs independently checked. Spec No blocking finding in the activation or staged plan. It preserves additive group references and uses the established operator ownership/fail-closed contract without re-reviewing operator source. Plan requires exact UID/member/privilege/binding readback, fresh morten allow and unrelated superuser deny, Git membership grant/removal, drift/restart/error recovery and retained group identity. Approved temporary tests must stay on the canary; do not alter shared/admin or unmanaged groups. No provisioning, password or email-trust change is authorized. Non-blocking UNKNOWN (acceptance pending): actual fresh OAuth authorization is unverified. This is a prerequisite to advancing beyond the canary, not evidence of an exploit or a review waiver. Use authorized existing account contexts; audited impersonation only if available/authorized. Keep cookies, codes, tokens and credentials in memory and out of output. A code issuance proves IdP authorization only; report Mealie's separate login/verified-email gates and existing sessions/token lifetimes independently. If contexts are unavailable, stop and request that prerequisite. Verification: locally lint, selected-app enrollment assertions and seven verified-email tests pass with the hash-verified published package. Local Helm 4.3 dependency resolution failed despite the public index containing 0.2.0; direct published package download enabled render validation. kubeconform unavailable locally; server dry-run is author's evidence. Live kubectl get applications -n argocd confirms core/shared 8e441bb and authentik 0.2.0 Synced/Healthy; Mealie remains 2d35b01 Synced/Healthy. Pod read confirms operator digest 4dbc3662... Ready, zero restarts. AuthentikClient/Group reads are Forbidden under this role, so exact remote membership/bindings remain stage-1 supplied evidence. Software Engineer must repeat kubectl get authentikclients -A -o json and kubectl get authentikgroups -A -o json plus sanitized Authentik API application/binding/group inventory before cutover; omit Secret/ConfigMap payloads and all credentials/tokens. Keep unmerged until Morten's staged cutover decision. After approval, verify mirror/Argo exact revision, current Ready/AccessReady and actual fresh authorization including grant/removal and fail-closed cases before another app. Stop on failure, close/disconnect affected application, restore reviewed access through GitOps; chart revert alone does not restore remote bindings/memberships or revoke sessions. Do not downgrade operator or delete/adopt retained identities as automatic rollback. Standards: 1 non-blocking LOW; Spec: 1 non-blocking UNKNOWN. No blocking code finding; cutover approval and actual acceptance remain separate gates.

morten-olsen merged commit c8270817d2 into main

2026-10-29 23:06:24 +01:00

morten-olsen referenced this pull request

2026-10-29 23:23:11 +01:00

test(mealie): restore canary after fail-closed checks #184