feat(tlsbridge): localhost-bind :9094 when bridging; validate the CA Secret

Two operator-path hardenings, both load-time:
- When tls_bridge.mode=enabled, Load() rewrites listener.session_api_addr to
  127.0.0.1 (preserving the port) so the session API — which now carries
  decrypted bodies — isn't reachable by other pods. kubectl port-forward
  (abctl) still works (it targets the pod's loopback). No auth, no redaction
  yet; this just shrinks the reachable surface.
- NewFileSource now fails loud on a misissued cert-manager Secret: rejects a
  non-CA cert (IsCA=false / missing KeyUsageCertSign) and a cert/key public-key
  mismatch. Previously these loaded 'fine' and silently failed at signing time
  → every call tunnels with no error. Turns a misconfigured Secret into a clear
  startup failure.

Tests: TestForceLocalhost, TestLoad_TLSBridgeHardensSessionAPI,
TestFileSource_RejectsNonCAOrMismatch.

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -5,6 +5,7 @@ package config
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"os"
 	"strings"
 
@@ -510,7 +511,27 @@ func Load(path string) (*Config, error) {
 		if err := cfg.TLSBridge.Validate(); err != nil {
 			return nil, err
 		}
+		// With the bridge on, the session API may carry decrypted request/response
+		// bodies; restrict its bind to loopback so other pods can't scrape it.
+		// kubectl port-forward (abctl) still works — it targets the pod's loopback.
+		if cfg.TLSBridge.Mode == "enabled" {
+			cfg.Listener.SessionAPIAddr = forceLocalhost(cfg.Listener.SessionAPIAddr)
+		}
 	}
 
 	return &cfg, nil
 }
+
+// forceLocalhost rewrites a bind address to 127.0.0.1, preserving the port:
+// ":9094" / "0.0.0.0:9094" / "[::]:9094" -> "127.0.0.1:9094". Empty stays empty;
+// a malformed address is left as-is so the bind itself surfaces the error.
+func forceLocalhost(addr string) string {
+	if addr == "" {
+		return ""
+	}
+	_, port, err := net.SplitHostPort(addr)
+	if err != nil {
+		return addr
+	}
+	return net.JoinHostPort("127.0.0.1", port)
+}

authbridge/authlib/config/config_test.go

@@ -779,6 +779,44 @@ func TestTLSBridgeConfig_Validate(t *testing.T) {
 	}
 }
 
+func TestForceLocalhost(t *testing.T) {
+	cases := map[string]string{
+		":9094":             "127.0.0.1:9094",
+		"0.0.0.0:9094":      "127.0.0.1:9094",
+		"[::]:9094":         "127.0.0.1:9094",
+		"127.0.0.1:9094":    "127.0.0.1:9094",
+		"":                  "",
+		"no-port-malformed": "no-port-malformed", // left as-is; bind surfaces the error
+	}
+	for in, want := range cases {
+		if got := forceLocalhost(in); got != want {
+			t.Errorf("forceLocalhost(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+// With the bridge enabled, Load() restricts the session API to loopback so
+// other pods can't scrape decrypted bodies.
+func TestLoad_TLSBridgeHardensSessionAPI(t *testing.T) {
+	y := []byte("mode: proxy-sidecar\n" +
+		"listener:\n" +
+		"  session_api_addr: \":9094\"\n" +
+		"tls_bridge:\n" +
+		"  mode: enabled\n" +
+		"  ca_dir: /etc/authbridge/tls-bridge-ca\n")
+	p := filepath.Join(t.TempDir(), "cfg.yaml")
+	if err := os.WriteFile(p, y, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg, err := Load(p)
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.Listener.SessionAPIAddr != "127.0.0.1:9094" {
+		t.Errorf("session_api_addr = %q, want 127.0.0.1:9094 (bridge on => loopback)", cfg.Listener.SessionAPIAddr)
+	}
+}
+
 // Absent mtls block leaves cfg.MTLS nil — today's behavior, no TLS.
 func TestLoad_MTLS_AbsentBlock(t *testing.T) {
 	dir := t.TempDir()

authbridge/authlib/tlsbridge/ca.go

@@ -90,6 +90,21 @@ func NewFileSource(certPath, keyPath string) (CASource, error) {
 	if err != nil {
 		return nil, err
 	}
+	// Fail loud at load on a misissued Secret. Without these checks a non-CA or
+	// mismatched cert/key loads "fine" and then silently fails to sign minted
+	// leaves at request time → the agent rejects the chain → every call falls
+	// open to tunnel, with no error. A cert-manager Secret can be misconfigured
+	// (wrong issuerRef, leaf instead of CA, mid-rotation key mismatch), so verify.
+	if !cert.IsCA {
+		return nil, fmt.Errorf("tlsbridge: CA cert %s is not a CA (IsCA=false)", certPath)
+	}
+	if cert.KeyUsage != 0 && cert.KeyUsage&x509.KeyUsageCertSign == 0 {
+		return nil, fmt.Errorf("tlsbridge: CA cert %s lacks KeyUsageCertSign", certPath)
+	}
+	pub, ok := cert.PublicKey.(interface{ Equal(x crypto.PublicKey) bool })
+	if !ok || !pub.Equal(key.Public()) {
+		return nil, fmt.Errorf("tlsbridge: CA cert %s and key %s do not match", certPath, keyPath)
+	}
 	return &staticSource{cert: cert, key: key, certPEM: certPEM}, nil
 }
 

authbridge/authlib/tlsbridge/ca_test.go

@@ -114,3 +114,50 @@ func TestFileSource_RejectsGarbage(t *testing.T) {
 		})
 	}
 }
+
+func TestFileSource_RejectsNonCAOrMismatch(t *testing.T) {
+	// writePair builds a self-signed cert from certKey and writes it next to
+	// fileKey (PKCS#8). When certKey != fileKey the cert/key public keys differ.
+	writePair := func(t *testing.T, isCA bool, certKey, fileKey *ecdsa.PrivateKey) (string, string) {
+		t.Helper()
+		tmpl := &x509.Certificate{
+			SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "t"},
+			NotBefore: time.Now().Add(-time.Minute), NotAfter: time.Now().Add(time.Hour),
+			IsCA: isCA, BasicConstraintsValid: true,
+		}
+		if isCA {
+			tmpl.KeyUsage = x509.KeyUsageCertSign
+		}
+		der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, certKey.Public(), certKey)
+		if err != nil {
+			t.Fatalf("create cert: %v", err)
+		}
+		dir := t.TempDir()
+		certP := filepath.Join(dir, "tls.crt")
+		keyP := filepath.Join(dir, "tls.key")
+		kd, _ := x509.MarshalPKCS8PrivateKey(fileKey)
+		if err := os.WriteFile(certP, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o600); err != nil {
+			t.Fatalf("write cert: %v", err)
+		}
+		if err := os.WriteFile(keyP, pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: kd}), 0o600); err != nil {
+			t.Fatalf("write key: %v", err)
+		}
+		return certP, keyP
+	}
+
+	k1, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	k2, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+
+	t.Run("non-CA cert", func(t *testing.T) {
+		certP, keyP := writePair(t, false, k1, k1) // matching key, but IsCA=false
+		if _, err := NewFileSource(certP, keyP); err == nil {
+			t.Fatal("expected error for IsCA=false cert, got nil")
+		}
+	})
+	t.Run("mismatched cert/key", func(t *testing.T) {
+		certP, keyP := writePair(t, true, k1, k2) // cert carries k1's pubkey; file holds k2
+		if _, err := NewFileSource(certP, keyP); err == nil {
+			t.Fatal("expected error for cert/key mismatch, got nil")
+		}
+	})
+}