ERA-60186, ERA-60187: CVEs fixes, NDB resource cluster scope change by shivaprasadmb · Pull Request #206 · nutanix-cloud-native/ndb-operator

shivaprasadmb · 2026-02-20T11:04:59Z

What this PR does / why we need it:
Makes NDBServer cluster-scoped and replaces credentialSecret (string) with credentialSecretRef (name + namespace). Admins can store the NDB API credential secret in a restricted namespace (e.g. ndb-credentials); developers reference the cluster-scoped NDBServer by name in ndbRef and no longer need access to that secret’s namespace. Also adds dedicated ndb-credentials namespace in automation, updates README and upgrade notes, and fixes a possible nil dereference in two automation test helpers.

Which issue(s) this PR fixes
Fixes #
Use bitnami/kube-rbac-proxy inplace of quay.io/brancz/kube-rbac-proxy :

its secure (contain 0 CVEs) and it generally points to upstream quay.io image
verified the functionality of new image by installing operator with bitnami image as side-car container
Below are the screenshots

Sample security report of bitnami image

How Has This Been Tested?:

make generate manifests and go build ./...
make deploy to a local cluster; confirmed NDBServer CRD is cluster-scoped and uses credentialSecretRef
Automation: provisioning (MySQL) and cloning (MySQL) with NDB secret in ndb-credentials and cluster-scoped NDBServer
below are logs and screenshots to verify that the ndb-server resource is cluster scoped and ndb secret is created in different namespace.

NOTE! : automation tests are run using OOB profiles and is updated to use new code logic.

MYSQL provisioning

MYSQL cloning

PGSI provisioning

PGSI cloning

Special notes for your reviewer:

Please confirm that if this PR changes any image versions, then that's the sole change this PR makes.

Release note:


- NDBServer is cluster-scoped and uses credentialSecretRef (name + namespace) instead of credentialSecret.
- Admins: create the NDB API credential secret in a dedicated namespace (e.g. ndb-credentials) and set spec.credentialSecretRef.
- Developers: reference NDBServer by name in Database ndbRef only (no namespace).
- Breaking: Existing NDBServer resources need a one-time migration (see README).

* feat: support name-based inputs for cluster, source database, and snapshot - Add name fields (clusterName, sourceDatabaseName, snapshotName) to API types - Make UUID fields optional when name is provided - Add NDB API functions to resolve names to UUIDs - Update validation to accept either UUID or name - Integrate name resolution in controller before API calls - Maintain backward compatibility with UUID inputs * test: update test configs to support name-based inputs - Add optional name fields (clusterName, sourceDatabaseName, snapshotName) to test configs - Keep clusterId/sourceDatabaseId/snapshotId for backward compatibility - Update test setup to support both UUID and name inputs via env vars - Update cloning helpers to respect names if provided - Update README documentation with name examples * fix: update webhook tests for name-based validation - Update test expectations to match new validation messages - Fix variable shadowing in instance_manager (err assignment) - Tests now expect 'Either X or Y must be provided' messages * chore: update generated files - Update RBAC role with latest controller-gen v0.18.0 - Format code with go fmt * fix: restore original webhook test setup from v0.5.2 * fix: update webhook test expectations for name-based validation * Fix snapshot name resolution to pick latest snapshot When multiple snapshots share the same name, the operator now correctly picks the most recent snapshot instead of the first one encountered. Changes: - Added SnapshotTimeStampDate field to SnapshotResponse struct - Modified ResolveSnapshotNameToId to collect all matching snapshots, compare timestamps, and return the ID of the most recent one Verified: Clone operation now uses cb7d85f2... (Feb 05) instead of aa34c323... (Jan 23) when given snapshotName "era_auto_snapshot" * Update test configurations to use name-based resolution by default - Updated all provisioning and cloning test configs (Mongo, MSSQL, MySQL, PostgreSQL) to use name-based inputs (clusterName, sourceDatabaseName, snapshotName) as the default - UUID-based fields (clusterId, sourceDatabaseId, snapshotId) are now commented out as alternatives - Enhanced test suite utilities to properly handle name-based resolution testing - Updated kustomization.yaml with latest operator image configuration - Minor improvements to name resolution controller adapter All tests have been validated for both provisioning and cloning operations across all four database types. * Add .env template and update .gitignore * Update README comments Co-authored-by: Cursor <cursoragent@cursor.com> * Update README secret comment Co-authored-by: Cursor <cursoragent@cursor.com> * Run go fmt Co-authored-by: Cursor <cursoragent@cursor.com> * Fix snapshot index bug in cloning helpers Co-authored-by: Cursor <cursoragent@cursor.com> * Refactor name resolution code Reorganize NDB API functions by entity and fix env file handling Co-authored-by: Cursor <cursoragent@cursor.com> * empty commit Co-authored-by: Cursor <cursoragent@cursor.com> * empty commit * Replace Synopsys Black Duck workflows with new implementation --------- Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

config/crd/bases/ndb.nutanix.com_ndbservers.yaml

sasikanthmasini · 2026-02-26T06:38:58Z

automation/tests/provisioning/mssql-si_test/config/database.yaml

-        name: "DEFAULT_SQLSERVER_DATABASE_PARAMS"
-      dbParamInstance:
-        name: "DEFAULT_SQLSERVER_INSTANCE_PARAMS"
+    profiles: {}


If automation is run with webhooks enabled, this manifest will be rejected at admission.

I have kept dbparams for MSSQL now, please review

…er scope

shivaprasadmb force-pushed the bug/vulnerability-fixes branch from 98d7006 to 2718665 Compare February 20, 2026 11:13

shivaprasadmb changed the title ~~Bug/vulnerability fixes~~ ERA-60186, ERA-60187: Bug/vulnerability fixes Feb 20, 2026

shivaprasadmb force-pushed the bug/vulnerability-fixes branch 5 times, most recently from 7dac734 to bfc0f9d Compare February 22, 2026 16:41

shivaprasadmb force-pushed the bug/vulnerability-fixes branch from bfc0f9d to 3a51486 Compare February 23, 2026 03:21

ERA-60187, ERA-60187: fix vulnerabilities

2564bc8

Co-authored-by: Cursor <cursoragent@cursor.com>

shivaprasadmb force-pushed the bug/vulnerability-fixes branch from 3a51486 to 2564bc8 Compare February 23, 2026 03:48

shivaprasadmb added 2 commits February 23, 2026 13:07

ERA-60183: secret namespace changes

a2ed3d9

changes 2

5f6caea

shivaprasadmb requested review from krunal-jhaveri, mazin-s and sasikanthmasini February 23, 2026 16:18

shivaprasadmb self-assigned this Feb 23, 2026

shivaprasadmb added 2 commits February 24, 2026 11:28

use OOB profile in automation tests provisioning

84863e9

use bitnami registry for kube-rbac-proxy image

1c6d5cb

shivaprasadmb requested a review from manavrajvanshi February 26, 2026 05:26

sasikanthmasini reviewed Feb 26, 2026

View reviewed changes

shivaprasadmb added 2 commits February 26, 2026 14:21

added instructions for ndb reource migration from namespaced to clust…

5d0c8e1

…er scope

keep dbparams for mssql in automation test

a893755

sasikanthmasini approved these changes Feb 26, 2026

View reviewed changes

shivaprasadmb changed the title ~~ERA-60186, ERA-60187: Bug/vulnerability fixes~~ ERA-60186, ERA-60187: CVEs fixes, NDB resource cluster scope change Feb 27, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ERA-60186, ERA-60187: CVEs fixes, NDB resource cluster scope change#206

ERA-60186, ERA-60187: CVEs fixes, NDB resource cluster scope change#206
shivaprasadmb wants to merge 8 commits intomainfrom
bug/vulnerability-fixes

shivaprasadmb commented Feb 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

sasikanthmasini Feb 26, 2026

Uh oh!

shivaprasadmb Feb 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

shivaprasadmb commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

sasikanthmasini Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

shivaprasadmb Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

shivaprasadmb commented Feb 20, 2026 •

edited

Loading