Skip to main content

Security model

DonkeyFleet assumes authenticated operators, a protected platform network, and independently managed identity, secrets, and database services.

Authentication and sessions​

Quarkus OIDC uses a confidential hybrid client and authorization-code flow. Session and login state are held in encrypted cookies, so application replicas do not require ingress affinity.

Every replica must use the same OIDC client secret. For production HA, configure an explicit shared session-encryption key of at least 32 characters; this also avoids logging everyone out when the OIDC client secret rotates.

Application paths require authentication except health, metrics, static assets, login, and signed-out pages. Browser mutations use double-submit-cookie CSRF protection. The secure-cookie flag is disabled only for standalone local HTTP.

Secrets and Vault​

ONTAP credentials live in Vault KV v2 and cluster registration stores only their path. Database, OIDC, session-encryption, and trust-store secrets are supplied at deployment. Never commit passwords, tokens, cluster endpoints, or FSx identifiers.

Kubernetes authentication has two identities:

  • the application ServiceAccount, which logs in and must be bound by the Vault role;
  • an optional reviewer ServiceAccount, whose token Vault can use for Kubernetes TokenReview.

When Vault performs client-side review, the application ServiceAccount itself needs system:auth-delegator. Grant it only with vaultKubernetesAuth.appAuthDelegator=true and only for that Vault configuration.

TLS and network controls​

Trust ONTAP certificates explicitly and avoid TLS-skip settings in production. Terminate browser HTTPS through the platform. Restrict browser, health, metrics, PostgreSQL, Vault, OIDC, and ONTAP paths with network policy or equivalent controls.

The chart can create an Ingress or HTTPRoute, but it does not install a controller, Gateway, or NetworkPolicy.

Storage and recovery boundary​

Every ONTAP mutation is destination-role guarded. Reinforce this invariant with read-only source credentials and separate destination credentials.

PostgreSQL contains authorization, intent, checkpoint, job, and audit state. Back it up and test restore procedures. Losing it during active provisioning removes the primary recovery record even when the destination intent comment still exists.

Every mutating console action and applied storage action records the authenticated OIDC subject.