Add input/output sanitization and security improvements

* Change operator logger from development to production mode to avoid
  leaking heavy stack traces that can contain internal information on
  warning+ log levels. Development logs can still be enabled using the
  --zap-devel argument.

* Add RunAsNonRoot and drop all Linux capabilities on the Postgres
  container.

* Add kubebuilder validation constraints:
  - URL pattern on LLMEndpoint
  - Format pattern on OGXLogLevel
  - minimum=1 on MaxTokensForResponse

* Add HTTP security headers to the console plugin nginx config
  (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)

Signed-off-by: Lucas Alvares Gomes <lucasagomes@gmail.com>

Author: umago

Makefile

@@ -156,7 +156,7 @@ build: manifests generate fmt vet ## Build manager binary.
 
 .PHONY: run
 run: manifests generate fmt vet ## Run a controller from your host.
-	source ./scripts/env.sh && go run ./cmd/main.go
+	source ./scripts/env.sh && go run ./cmd/main.go $(ARGS)
 
 # If you wish to build the manager image targeting other platforms you can use the --platform flag.
 # (i.e. docker build --platform linux/arm64). However, you must enable docker buildKit for it.

README.md

@@ -169,9 +169,11 @@ If you are making changes to the operator you can run the operator locally
 (outside the cluster) using the Operator SDK make targets:
 
 ```bash
-make install run
+make install run ARGS="--zap-devel"
 ```
 
+Note: `--zap-devel` enable verbose (development) logging locally.
+
 This will:
 
 1. Install the CRDs into your cluster.

api/v1beta1/openstacklightspeed_types.go

@@ -116,6 +116,7 @@ type OpenStackLightspeedSpec struct {
 type LoggingConfig struct {
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:default="all=info"
+	// +kubebuilder:validation:Pattern=`^\w+(?:=\w+)?(?:,\w+(?:=\w+)?)*$`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="OGX Log Level"
 	// Log level configuration for the OGX/llama-stack container. Supports standard levels (INFO, DEBUG) or fine-grained control using format "component=level,component=level" (e.g., "core=debug,providers=info").
 	OGXLogLevel string `json:"ogxLogLevel,omitempty"`
@@ -138,6 +139,7 @@ type LoggingConfig struct {
 // OpenStackLightspeedCore defines the desired state of OpenStackLightspeed
 type OpenStackLightspeedCore struct {
 	// +kubebuilder:validation:Required
+	// +kubebuilder:validation:Pattern=`^https?://.+`
 	// +operator-sdk:csv:customresourcedefinitions:type=spec,displayName="LLM Endpoint"
 	// URL pointing to the LLM
 	LLMEndpoint string `json:"llmEndpoint"`
@@ -165,6 +167,7 @@ type OpenStackLightspeedCore struct {
 	TLSCACertBundle string `json:"tlsCACertBundle"`
 
 	// +kubebuilder:validation:Optional
+	// +kubebuilder:validation:Minimum=1
 	// MaxTokensForResponse defines the maximum number of tokens to be used for the response generation
 	MaxTokensForResponse int `json:"maxTokensForResponse,omitempty"`
 

bundle/manifests/lightspeed.openstack.org_openstacklightspeeds.yaml

@@ -94,6 +94,7 @@ spec:
                 type: string
               llmEndpoint:
                 description: URL pointing to the LLM
+                pattern: ^https?://.+
                 type: string
               llmEndpointType:
                 description: Type of the provider serving the LLM
@@ -141,11 +142,13 @@ spec:
                     description: Log level configuration for the OGX/llama-stack container.
                       Supports standard levels (INFO, DEBUG) or fine-grained control
                       using format "component=level,component=level" (e.g., "core=debug,providers=info").
+                    pattern: ^\w+(?:=\w+)?(?:,\w+(?:=\w+)?)*$
                     type: string
                 type: object
               maxTokensForResponse:
                 description: MaxTokensForResponse defines the maximum number of tokens
                   to be used for the response generation
+                minimum: 1
                 type: integer
               modelName:
                 description: Name of the model to use at the API endpoint provided

cmd/main.go

@@ -92,7 +92,9 @@ func main() {
 	flag.StringVar(&keyName, "key-name", "tls.key",
 		"The name of the TLS key file.")
 	opts := zap.Options{
-		Development: true,
+		// Development: false uses JSON encoding and omits stack traces / DPanic behaviour.
+		// For local development use: make run ARGS="--zap-devel"
+		Development: false,
 	}
 	opts.BindFlags(flag.CommandLine)
 	flag.Parse()

config/crd/bases/lightspeed.openstack.org_openstacklightspeeds.yaml

@@ -94,6 +94,7 @@ spec:
                 type: string
               llmEndpoint:
                 description: URL pointing to the LLM
+                pattern: ^https?://.+
                 type: string
               llmEndpointType:
                 description: Type of the provider serving the LLM
@@ -141,11 +142,13 @@ spec:
                     description: Log level configuration for the OGX/llama-stack container.
                       Supports standard levels (INFO, DEBUG) or fine-grained control
                       using format "component=level,component=level" (e.g., "core=debug,providers=info").
+                    pattern: ^\w+(?:=\w+)?(?:,\w+(?:=\w+)?)*$
                     type: string
                 type: object
               maxTokensForResponse:
                 description: MaxTokensForResponse defines the maximum number of tokens
                   to be used for the response generation
+                minimum: 1
                 type: integer
               modelName:
                 description: Name of the model to use at the API endpoint provided

internal/controller/assets/console_nginx.conf.tmpl

@@ -18,5 +18,11 @@ http {
         ssl_certificate     /var/cert/tls.crt;
         ssl_certificate_key /var/cert/tls.key;
         root                /usr/share/nginx/html;
+        # Prevent this plugin from being embedded in an iframe (clickjacking protection).
+        add_header X-Frame-Options "DENY" always;
+        # Prevent browsers from MIME-sniffing JS/CSS assets away from their declared content-type.
+        add_header X-Content-Type-Options "nosniff" always;
+        # Only send the origin (no path or query) in the Referer header on cross-origin requests.
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     }
 }

internal/controller/postgres_deployment.go

@@ -171,6 +171,10 @@ func buildPostgresPodTemplateSpec() corev1.PodTemplateSpec {
 					SecurityContext: &corev1.SecurityContext{
 						AllowPrivilegeEscalation: &[]bool{false}[0],
 						ReadOnlyRootFilesystem:   &[]bool{true}[0],
+						RunAsNonRoot:             &[]bool{true}[0],
+						Capabilities: &corev1.Capabilities{
+							Drop: []corev1.Capability{"ALL"},
+						},
 					},
 					StartupProbe:   buildPostgresProbe(PostgresStartupProbePeriodSeconds, PostgresStartupProbeTimeoutSeconds, PostgresStartupProbeFailureThreshold, PostgresStartupProbeInitialDelaySeconds),
 					LivenessProbe:  buildPostgresProbe(PostgresLivenessProbePeriodSeconds, PostgresLivenessProbeTimeoutSeconds, PostgresLivenessProbeFailureThreshold, 0),