[backport v0.10 - rancher v2.14] reject user operations on rancher-managed resource quota and limit range resources - #1797#1797 - #1798

Open

andreas-kupries wants to merge 79 commits into

mainfrom

extended-quota-enforcement-2.14

andreas-kupries commented Aug 20, 2026

Contributor

Issue:

rancher/rancher#56774

Companion PR r/rancher rancher/rancher#56804

Problem

The NRQR (Rancher-managed namespace ResourceQuota, identified by label resourcequota.management.cattle.io/default-resource-quota: true) was enforced only at namespace creation time. Any user with RBAC access to resourcequotas could subsequently edit the object directly, fully bypassing project-level enforcement.

The same is true for the LimitRange resource managed by Rancher.

Solution

Added validating webhooks for ResourceQuota and LimitRange objects.
The companion PR modifies Rancher to send its requests using the webhook bypass.
This means that the new validators see only user initiated requests, and only have to reject operations involving the marker label. IOW

Reject attempts to create resources bearing the marker label
Reject attempts to delete resources bearing the marker label
Reject attempts to change resources bearing the marker label
- This includes changes attempting to strip the marker (demotion to unmanaged)
Reject attempts to add a marker to to un-marked resources (i.e. prevent promotion to managed)

joshmeranda and others added 30 commits

March 25, 2026 14:31


          Bump wrangler (#1299)

7c13c73

* go get github.com/rancher/wrangler/v3@v3.5.0

* go mod tidy

---------

Co-authored-by: joshmeranda <joshua.meranda@gmail.com>


          Pin GH Actions to commit sha (#1319)

691caae


          Update GitHub Actions (#1307)

8745ecb

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          restricting container from acquiring additional privileges (#1333)

c690656


          Use CAPI v1beta2 (#1328)

69d78d9

This PR bumps the cluster-api module to v1.12.2, and updates all usage of the v1beta1 API to v1beta2


          pin deps and add checksum verification (#1342)

cb73149

- Pin base images to SHA256 in Dockerfile
- Replace curl|sh golangci-lint install with verified tarball download
- Replace curl|bash k3d install with pinned v5.8.3 + checksum verification


          Update golang.org/x packages (#1351)

e64f935

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update Kubernetes dependencies (#1310)

9d4c2ac

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Bump wrangler, dynamiclistener (#1362)

7e4c1fa


          fixing securityContext location (#1369)

30b1a3a


          Update Go dev tools (#1350)

bbe5331

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Drop droneci (#1375)

ce5660f


          Update dependency go to v1.25.9 (#1378)

976da2f

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update registry.suse.com/bci/golang:1.25 Docker digest to c1a6327 (#1380

b73d37a

)

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update registry.suse.com/bci/golang:1.25 Docker digest to 6ab7d7e (#1386

2de0a56

)

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update Update Kubernetes dependencies to v0.35.4 (#1392)

f602baa

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update registry.suse.com/bci/bci-micro:15.7 Docker digest to 5ed5a19 (#…

f6373ac

…1391)

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          [release/v0.10] Bump to unRc'd wrangler, dynamiclistener (#1393)

d7f30bd

Bumped:
- github.com/rancher/wrangler/v3 to v3.5.1
- github.com/rancher/dynamiclistener to v0.8.1


          Sync dependencies (#1408)

bb52988

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          unRC Sync Dependencies (#1413)

81204b4

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Update bci-micro image (#1415)

facaa05


          [release/v0.10] Split release workflow into Cut release and On release (

9c2f567

#1434)

Backport of the workflow architecture used on main:

- Cut release (.github/workflows/cut-release.yaml) is the workflow_dispatch
  entry point. It validates the version against VERSION.md (read from the
  default branch), creates and pushes the annotated tag, then dispatches
  the On release workflow at the new tag ref via
  `gh workflow run release.yaml --ref <tag>`.

- On release (.github/workflows/release.yaml) is workflow_dispatch with a
  guard job that fails if the dispatched ref is not a tag. Builds for
  amd64 and arm64, creates the GitHub release with binaries + sha256sums
  + Helm chart, and runs publish-image.

The publish-image action's cosign provenance check requires the publish
to run from refs/tags/v*; dispatching On release at the new tag ref
satisfies this. A push:tags trigger does not work because GitHub blocks
workflow runs triggered by GITHUB_TOKEN from starting other runs via
push events; workflow_dispatch is exempt.


          Add and use push-prime-image target (#1304) (#1435)

0ba7285

Co-authored-by: Chad Roberts <chad.roberts@suse.com>


          Update GitHub Actions (#1335)

856c286

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update module golang.org/x/net to v0.53.0 [SECURITY] (#1442)

c87ba4f

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Bump wrangler to v3.6.0 (#1459)

3f98618

Bumps github.com/rancher/wrangler/v3 from v3.5.1 to v3.6.0
for Kubernetes v1.35 support in Rancher v2.14.2.


          Bump dynamiclistener and norman (#1461)

03dc98a

* Bump dynamiclistener

* Bump norman


          Adopt hardened-build-base to get Go 1.25.10 toolchain (#1471)

cd873e4


          Update golang.org/x packages (#1395)

7beee88

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Sync dependencies (#1482)

8fc4b04

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>

renovate-rancher Bot and others added 24 commits

June 29, 2026 06:43


          Update rancher/ecm-distro-tools action to v0.74.3 (#1625)

e4ee57f

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Add RCS Release workflow for staging registry (#1631)

4252d00


          Update GitHub Actions (#1636)

38017ca

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Sync dependencies (#1619)

be63469

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Update module golang.org/x/text to v0.39.0 (#1647)

fb82646

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Update GitHub Actions (#1653)

81fec7e

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          sync-deps: never recommend dependency downgrades (#1656) (#1657)

cfb8214

Compare versions with golang.org/x/mod/semver and only sync a dep
forward when rancher's version is strictly newer. Skip (no PR) when
webhook is already ahead. Falls back to the previous sync-to-rancher
behavior when a version string isn't valid semver.


          Update GitHub Actions (#1666)

bb7b0ae

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          Sync dependencies (#1643)

a395dd0

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Bump Go to 1.26.5 (#1684)

5d4ccf8


          Sync dependencies (#1691)

c50c2fc

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Sync dependencies (#1707)

4255d6f

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          [v0.10] Set the creatorId annotation on dry-run provisioning Cluster …

233dd91

…creates (#1743)

Backport of #1729

* Set the creatorId annotation on dry-run provisioning Cluster creates

The mutating webhook for provisioning Clusters returned early on every
dry-run request, before setting the creatorId annotation. The
validating webhook requires that annotation on dry-run creates, so
every server-side dry-run create was denied while the identical real
create succeeded. For PSACT-configured clusters the validating webhook
also checks the admission-config secret the mutator writes, which
fails the same way on dry-run since the write never happens.

The mutator's early return is replaced with a guard around only the
PSACT secret handling, the one stage with a real side effect. On
dry-run, the object parse, the creatorId annotation, the
dynamic-schema revert, and the JSON patch generation now run as they
do on a real request, so the preview patch matches the eventual apply.
The validating webhook skips only its checks against that
mutator-produced state (the secret and the cluster fields derived from
it) on dry-run; its pure input checks — the kubernetes version floor
and the template's existence — still run, so invalid input is denied
in the preview exactly as it would be on a real request. The patch
changes only the in-flight request object, which a dry-run never
persists, so the webhook's SideEffects: NoneOnDryRun registration
remains accurate.

* Document provisioning Cluster dry-run behavior

The Cluster admission webhooks previously lacked documentation
about their behavior on server-side dry-run requests. The docs
now cover three key areas: the creatorId annotation is set on
dry-run creates; dynamic-schema reverts apply to dry-run updates;
and Pod Security Admission Configuration Template checks run on
dry-run while secret management is skipped. Updated both the
per-resource and aggregate documentation.


          Update Kubernetes dependencies (#1727)

6bce896

Co-authored-by: renovate-rancher[bot] <119870437+renovate-rancher[bot]@users.noreply.github.com>


          add validation for crt ttl settings (#1746)

52cae9c


          Sync dependencies (#1677)

726ec5e

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Pin read-vault-secrets to a commit that SHA-pins hashicorp/vault-acti…

a81ffce

…on instead of tracking the v3 tag (#1750)


          Sync dependencies (#1756)

179b329

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Sync dependencies (#1760)

89628d6

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          pin rancher inCI to v2.14 (#1776)

b539c35

Co-authored-by: joshmeranda <joshua.meranda@gmail.com>


          [v0.10] Make User principalIds immutable (#1774)

eb1f0d1

Backport of #1772


          Sync dependencies (#1781)

dc755d0

Co-authored-by: rancher-pr-and-push-webhook[bot] <181785884+rancher-pr-and-push-webhook[bot]@users.noreply.github.com>


          Co-authored-by: andreas-kupries <577247+andreas-kupries@users.noreply…

3c78bcc

….github.com>

boilerplate from copilot still present. unit tests and checks completely rewritten

added validators for resource quota to webhook
added docs, extended webhook codegen

the new validator rejects creation, edition, deletion of rancher managed resources.
the new validator further rejects promotion of unmanaged to managed resource, and vice versa.
the managed resource is recognized by its marker label.

the validator is written with the assumption that rancher requests are tagged
with webhook bypass and therefore do not reach the validator.

unit tests.

all of the above for limit range resources as well.


          moved new validators out of MCM block, register unconditionally

73ccb5a

andreas-kupries added this to the 2.14.6 milestone

andreas-kupries self-assigned this

andreas-kupries requested a review from a team as a code owner

August 20, 2026 13:25

andreas-kupries added the team/collie label

This was referenced Aug 20, 2026

reject user operations on rancher-managed resource quota and limit range resources #1757

Open

bypass new webhook validation for resource quota and limit range rancher/rancher#56780

Open

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels