fix(openshift): block SCC escalation via annotations

[pratap0007]

Changes

Fixes a security vulnerability where empty maxAllowed in
TektonConfig.spec.platforms.openshift.scc allowed privilege
escalation to any SCC (including privileged) via namespace
annotations.

Implemented three-layer defense-in-depth:

• Layer 1: Default maxAllowed to match default SCC (prevents empty configuration)
• Layer 2: Namespace webhook validates the maxAllowed if it is empty then allow only default SCC.
• Layer 3: RBAC reconciler treats empty maxAllowed as default SCC (final enforcement)

This prevents attackers from annotating namespaces with
operator.tekton.dev/scc=privileged to gain node-level access.

Manual Testing on OpenShift Cluster

Prerequisites

• Deploy operator with these changes on Openshift cluster
• Verify TektonConfig exists and status is True: oc get tektonconfig config

Test Cases

✅ Test 1: Default SCC Should Be Allowed

cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: test-default-scc
  annotations:
    operator.tekton.dev/scc: "pipelines-scc"
EOF

Expected: Namespace created successfully
Cleanup: oc delete namespace test-default-scc

---

❌ Test 2: Privileged SCC Should Be Blocked (Security Fix)

cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: test-privileged
  annotations:
    operator.tekton.dev/scc: "privileged"
EOF

Expected: Error message:

Error from server: admission webhook denied the request: 
namespace test-privileged requested SCC privileged, but maxAllowed 
is not configured. Only the default SCC pipelines-scc is permitted

---

❌ Test 3: Anyuid SCC Should Be Blocked (Security Fix)

cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: test-anyuid
  annotations:
    operator.tekton.dev/scc: "anyuid"
EOF

Expected: Similar rejection with anyuid in the error message

---

✅ Test 4: Set maxAllowed - Verify Normal Flow Still Works

# Update TektonConfig
oc patch tektonconfig config --type=merge -p '
{
  "spec": {
    "platforms": {
      "openshift": {
        "scc": {
          "maxAllowed": "anyuid"
        }
      }
    }
  }
}'

# Wait 10 seconds for webhook to update
sleep 10

# Now anyuid should be allowed
cat <<EOF | oc apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: test-anyuid-allowed
  annotations:
    operator.tekton.dev/scc: "anyuid"
EOF

Expected: Namespace created successfully
Cleanup: oc delete namespace test-anyuid-allowed

---

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

-->

Fixed privilege escalation vulnerability in namespace SCC validation. When `maxAllowed` SCC is not configured, namespaces can now only use the default SCC (`pipelines-scc`), preventing unauthorized privilege escalation via namespace annotations.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 26.70%. Comparing base (d1d928c) to head (6f7df4a).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3994      +/-   ##
==========================================
+ Coverage   26.44%   26.70%   +0.25%     
==========================================
  Files         465      465              
  Lines       24991    25009      +18     
==========================================
+ Hits         6609     6678      +69     
+ Misses      17661    17601      -60     
- Partials      721      730       +9     

Flag	Coverage Δ
unit-tests	26.70% <ø> (+0.25%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jkhelil]

@pratap0007 Can you update docs/SCCConfig.md with the new approch

[jkhelil]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jkhelil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jkhelil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[khrm]

@pratap0007 Can you squash this? And push after fix?

[pratap0007]

Thank you, @anithapriyanatarajan, for the document updated and looks good to me.