Skip to content

fix(operator): FerrVaultConnection reports Ready=True without validating the token or scope #215

Description

@BryanFRD

Found during the 2026-08 FerrVault operator audit.

Problem

probe only performs an unauthenticated GET /health (internal/ferrvault/client.go:100-129, Probe explicitly "does not exercise the token"), yet ConnectionStatus.Conditions is documented as "True when the token authenticates and the secrets:read scope is present" (api/ferrvault/v1alpha1/connectionspec_types.go:143-145). Reconcile at ferrvaultconnection_controller.go:141-163.

Impact

A connection with an invalid/expired/wrong-scope token reports Ready=True, Reachable. The auth failure only surfaces later on the dependent FerrVaultSecret, making the primary troubleshooting surface misleadingly green.

Fix

Either make the probe do a cheap authenticated call (e.g. an operator me/scoped no-op) so Ready reflects auth, or correct the doc + condition semantics to state clearly that Reachable/Ready only checks reachability, not credentials.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    P2Medium prioritybugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions