refactor: enhance validation for service account key path and API base path in config

Author: slm0n87

deploy/stackit/values.yaml

@@ -43,7 +43,7 @@ stackitSaAuthentication:
   secretName: stackit-sa-authentication
   # -- key of the service account key in the secret. Which will be later be used to load in keys in the pod as well.
   fileName: sa.json
-  # -- Path where the secret will be mounted in the pod.
+  # -- Path where the secret will be mounted in the pod. Must be /var/run/secrets/stackit/
   mountPath: /var/run/secrets/stackit
 
 # -- Configuration for the webhook service.

internal/resolver/config.go

@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path/filepath"
+	"regexp"
 	"strings"
 
 	extapi "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
@@ -40,21 +42,36 @@ func (d defaultConfigProvider) LoadConfig(cfgJSON *extapi.JSON) (StackitDnsProvi
 		return cfg, err
 	}
 
-	if err := validateConfig(&cfg); err != nil {
+	setDefaultValues(&cfg)
+
+	webhookNamespace, err := determineNamespace(d.fileNamespaceName)
+	if err != nil {
 		return cfg, err
 	}
 
-	setDefaultValues(&cfg)
+	if cfg.AuthTokenSecretNamespace == "" {
+		cfg.AuthTokenSecretNamespace = webhookNamespace
+	}
 
-	namespace, err := determineNamespace(cfg.AuthTokenSecretNamespace, d.fileNamespaceName)
-	if err != nil {
+	if err := validateSecretNamespace(cfg.AuthTokenSecretNamespace, webhookNamespace); err != nil {
+		return cfg, err
+	}
+
+	if err := validateConfig(&cfg); err != nil {
 		return cfg, err
 	}
-	cfg.AuthTokenSecretNamespace = namespace
 
 	return cfg, nil
 }
 
+func validateSecretNamespace(configuredNamespace, webhookNamespace string) error {
+	// Secrets must be in the same namespace as the webhook
+	if configuredNamespace != webhookNamespace {
+		return fmt.Errorf("authTokenSecretNamespace must be %s, got: %s", webhookNamespace, configuredNamespace)
+	}
+	return nil
+}
+
 func unmarshalConfig(cfgJSON *extapi.JSON, cfg *StackitDnsProviderConfig) error {
 	if err := json.Unmarshal(cfgJSON.Raw, cfg); err != nil {
 		return fmt.Errorf("error decoding solver configProvider: %w", err)
@@ -68,6 +85,38 @@ func validateConfig(cfg *StackitDnsProviderConfig) error {
 		return fmt.Errorf("projectId must be specified")
 	}
 
+	if err := validateApiBasePath(cfg.ApiBasePath); err != nil {
+		return err
+	}
+
+	if cfg.ServiceAccountKeyPath != "" {
+		if err := validateSaKeyPath(cfg.ServiceAccountKeyPath); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func validateApiBasePath(apiBasePath string) error {
+	pattern := "^https://dns\\.api(?:\\.[a-z0-9-]+)?\\.stackit\\.cloud/?$"
+
+	if matched, err := regexp.MatchString(pattern, apiBasePath); err == nil && matched {
+		return nil
+	}
+
+	return fmt.Errorf("apiBasePath not allowed: %s", apiBasePath)
+}
+
+func validateSaKeyPath(keyPath string) error {
+	allowedPrefix := "/var/run/secrets/stackit/"
+
+	clean := filepath.Clean(keyPath)
+
+	if !strings.HasPrefix(clean, allowedPrefix) && clean != strings.TrimSuffix(allowedPrefix, "/") {
+		return fmt.Errorf("serviceAccountKeyPath must be within %s, got: %s", allowedPrefix, clean)
+	}
+
 	return nil
 }
 
@@ -86,11 +135,7 @@ func setDefaultValues(cfg *StackitDnsProviderConfig) {
 	}
 }
 
-func determineNamespace(currentNamespace string, fileNamespaceName string) (string, error) {
-	if currentNamespace != "" {
-		return currentNamespace, nil
-	}
-
+func determineNamespace(fileNamespaceName string) (string, error) {
 	data, err := os.ReadFile(fileNamespaceName)
 	if err != nil {
 		return "", fmt.Errorf("failed to find the webhook pod namespace: %w", err)