docs: add namespace isolation design and promote security hardening to ADR by alexeykazakov · Pull Request #62 · codeready-toolchain/claw-operator

alexeykazakov · 2026-04-17T03:01:23Z

Add namespace-isolation-design.md: two-namespace architecture for safe Kubernetes API access using Dev Sandbox SpaceRequest API
Promote security hardening proposals to ADR-0001, distilling decisions and rationale from 5 proposal files into one record

Summary by CodeRabbit

Documentation

Added Architecture Decision Record documenting security hardening design for Claw Operator deployments, including credential management, proxy configuration, NetworkPolicy ingress controls, and container hardening specifications.
Added New design proposal for Kubernetes namespace isolation architecture, detailing deployment strategy across dedicated sub-namespaces with credential and enforcement resource management.
Reorganized security hardening proposal documentation for clarity and maintainability.

…o ADR - Add namespace-isolation-design.md: two-namespace architecture for safe Kubernetes API access using Dev Sandbox SpaceRequest API - Promote security hardening proposals to ADR-0001, distilling decisions and rationale from 5 proposal files into one record - Delete original proposal files (design, questions, impl-questions, credential-examples, sketch) - Mark Phase 3 (kubernetes credential type) as deferred, referencing the namespace isolation design - Fix whitespace alignment in PROJECT_VISION.md Signed-off-by: Alexey Kazakov <alkazako@redhat.com> Made-with: Cursor

coderabbitai · 2026-04-17T03:02:16Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2cfa1a18-582e-4901-b19a-7d1092a479f1

📥 Commits

Reviewing files that changed from the base of the PR and between a8c92fc and 4b4bd9b.

📒 Files selected for processing (8)

docs/PROJECT_VISION.md
docs/adr/0001-security-hardening.md
docs/proposals/namespace-isolation-design.md
docs/proposals/security-hardening-credential-examples.md
docs/proposals/security-hardening-design.md
docs/proposals/security-hardening-impl-questions.md
docs/proposals/security-hardening-questions.md
docs/proposals/security-hardening-sketch.md

💤 Files with no reviewable changes (5)

docs/proposals/security-hardening-credential-examples.md
docs/proposals/security-hardening-sketch.md
docs/proposals/security-hardening-questions.md
docs/proposals/security-hardening-design.md
docs/proposals/security-hardening-impl-questions.md

Walkthrough

Documentation reorganization consolidates security hardening specifications for the Claw Operator. Multiple exploratory proposal documents are removed and superseded by a formal ADR and comprehensive namespace isolation design proposal. A minor spacing adjustment is applied to the project vision diagram.

Changes

Cohort / File(s)	Summary
Project Documentation Update `docs/PROJECT_VISION.md`	Minor whitespace adjustment to ASCII architecture diagram alignment; no content changes.
New Security Architecture Documentation `docs/adr/0001-security-hardening.md`, `docs/proposals/namespace-isolation-design.md`	Added formal ADR documenting two-phase security hardening design with inline credentials, credential-injecting proxy, NetworkPolicy, and hardening controls. Added comprehensive namespace isolation proposal detailing two-namespace split architecture using SpaceRequest API, service-account credential injection, and exfiltration mitigations.
Removed Proposal Documentation `docs/proposals/security-hardening-*.md`	Deleted five superseded proposal documents: `security-hardening-credential-examples.md`, `security-hardening-design.md`, `security-hardening-impl-questions.md`, `security-hardening-questions.md`, and `security-hardening-sketch.md`. Content consolidated into new ADR and namespace isolation design.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main changes: adding namespace isolation design documentation and promoting security hardening content to ADR format.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

xcoulon · 2026-04-17T08:27:43Z

+Separate the security infrastructure from the user's workspace using a dedicated `-claw` namespace:
+
+```
+alice-dev (user's workspace, unchanged)       alice-{uid}-claw (new, Claw system)


why alice-{uid}-claw and not just alice-claw?

This is how SR controller works. I guess we needed it to make sure the ns name is unique

xcoulon · 2026-04-17T08:28:34Z

+
+```
+alice-dev (user's workspace, unchanged)       alice-{uid}-claw (new, Claw system)
+├── user's deployments                        ├── claw (gateway pod)


I assume that the alice-{uid}-claw ns will also contain a secret with the token for the Assistant SA that exists in the alive-dev ns? (just saying that the diagram could include it)

Yeah, it's in a different diagram in the doc:

Dashboard sees SpaceRequest Ready=True: ... - Creates assistant SA kubeconfig Secret in the -claw namespace

xcoulon · 2026-04-17T13:47:00Z

+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["get", "list", "watch"]
+  # View Route to find the URL


the user may want to see the Service and ConfigMaps as well

xcoulon · 2026-04-17T13:48:29Z

+#### ns_claw.yaml — NetworkPolicies
+
+Includes:
+- **Sandbox-standard ingress policies**: `allow-from-openshift-ingress`, `allow-from-openshift-monitoring`, `allow-from-console-namespaces`, etc. (same as `-dev`)


I don't think we need allow-from-openshift-monitoring for users' deployments of Claw

xcoulon · 2026-04-17T13:49:51Z

+
+---
+
+## Implementation: SpaceRequest API


I'm confused with the SpaceRequest API here: can't we have a Tier with 2 namespaces in case the user signs up for Claw on sandbox.redhat.com?

xcoulon reviewed Apr 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: add namespace isolation design and promote security hardening to ADR#62

docs: add namespace isolation design and promote security hardening to ADR#62
alexeykazakov wants to merge 1 commit intocodeready-toolchain:masterfrom
alexeykazakov:docs/namespace-isolation-and-adr

alexeykazakov commented Apr 17, 2026 •

edited by coderabbitai bot

Loading

Uh oh!

coderabbitai bot commented Apr 17, 2026 •

edited

Loading

Uh oh!

xcoulon Apr 17, 2026

Uh oh!

alexeykazakov Apr 17, 2026

Uh oh!

xcoulon Apr 17, 2026

Uh oh!

alexeykazakov Apr 17, 2026

Uh oh!

xcoulon Apr 17, 2026

Uh oh!

xcoulon Apr 17, 2026

Uh oh!

xcoulon Apr 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

alexeykazakov commented Apr 17, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Documentation

Uh oh!

coderabbitai bot commented Apr 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

xcoulon Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

alexeykazakov Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

xcoulon Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

alexeykazakov Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

xcoulon Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

xcoulon Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

xcoulon Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

alexeykazakov commented Apr 17, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Apr 17, 2026 •

edited

Loading