feat: security fixes, GKE/AKS support, telemetry, dashboard improvements - #13
Merged
Conversation
…ashboard on connect
… collapsible score breakdown
…ponents/dashboard/
…S policy formatting, memory in GB - Logs tab fits within viewport height without page scroll - Resources tab uses shadcn Table with CPU/memory columns - DNS Policy uses formatLabel() in Overview and Networking tabs - formatMemory canonical in lib/k8s/utils, re-exported from dashboard utils - Header stats renamed to CPU Req / Mem Req
…s tab with pod selector - Remove Revision quick stat from header - Apply formatLabel to Strategy in header and Overview info panel - Remove Replica Status and Pods panels from Overview tab - Add Logs tab: pod selector + container selector, tail/since filters, search, live mode
- Collect app version, cluster count, provider types, k8s versions - 3h ping interval via instrumentation.js startup hook + dashboard re-trigger - HMAC-SHA256 signed + SHA256 proof-of-work (difficulty 16) for anti-forgery - Telemetry endpoint and secret baked at Docker build time via ARGs - TELEMETRY_DISABLED=true env var for honest opt-out - Settings → About tab shows enabled status, install ID, last ping, last payload - GitHub Actions passes secrets as Docker build-args
- serializeKubeConfig: resolve exec-based tokens (GKE gke-gcloud-auth-plugin) via applyToFetchOptions after validateConnection caches the result - serializeKubeConfig: normalize caFile/certFile/keyFile to inline base64 so file paths are not lost when credentials are forwarded via request headers - isolateContext: new helper that clones a single-context KubeConfig from a shared multi-context one to prevent race conditions in Promise.all - auto-detect + upload routes: use isolateContext per context instead of mutating shared KubeConfig with setCurrentContext across parallel promises; the shared object mutation was corrupting Docker TLS state when GKE exec auth awaited mid-flight
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's in this PR
This brings
developmentup to date withmain, covering four areas of work shipped since the last merge.Security fixes
Three vulnerabilities identified in a security review and patched:
SSRF — cluster connect & upload routes:
apiEndpointfrom the POST body and kubeconfigserverfields from uploaded files were passed directly to the Kubernetes client without being checked against the existingisBlockedServerUrlblocklist. An attacker could supplyhttp://169.254.169.254to hit the cloud instance metadata endpoint. Fixed by callingisBlockedServerUrlin bothconnect/route.jsxandupload/route.jsxbefore any outbound connection is made.Arbitrary file read — kubeconfig cert paths:
fileToBase64inlib/k8s/client.jscalledreadFileSyncon file paths taken directly from user-supplied kubeconfigs (thecertificate-authority,client-certificate, andclient-keyfields). A crafted kubeconfig could read any file accessible to the Node.js process and return its contents in the API response. Fixed by restricting reads to an allowlist of legitimate cert directories (~/.kube/,/etc/kubernetes/,/var/lib/kubelet/).SSRF — request header forwarding:
getClientsFromRequestforwardedx-cluster-serverto the Kubernetes client without a blocklist check, meaning all ~15 API proxy routes were unprotected.isBlockedServerUrlwas only being called in 2 of those routes. Fixed by moving the check intogetClientsFromRequestitself so protection is applied centrally and can't be missed on new routes.GKE and AKS compatibility
serializeKubeConfignow resolves exec-based tokens (e.g.gke-gcloud-auth-plugin) viaapplyToFetchOptionsaftervalidateConnectionwarms the cache, then extracts the resolved Bearer token for header forwarding.caFile,certFile, andkeyFilepaths are now inlined as base64 at serialize time so TLS credentials are not lost when forwarded via request headers.isolateContextclones a single-contextKubeConfigfrom a shared multi-context one. The upload and auto-detect routes now use it instead of callingsetCurrentContexton a shared object across parallelPromise.allbranches, which was corrupting Docker TLS state mid-flight.Anonymous telemetry
AppShell, covers all pages without duplicating pings.TELEMETRY_DISABLED=true); opt-out via env var.NEXT_TELEMETRY_DISABLED=1also set.TELEMETRY_HMAC_SECRET,TELEMETRY_ENDPOINT, andTELEMETRY_POW_DIFFICULTYpassed as build-args from GitHub Actions secrets.Dashboard & workload improvements
SharedLogsTab.formatLabel; memory displayed in GB.Build & config
package.jsonat build time viaNEXT_PUBLIC_APP_VERSION— Settings → About always shows the correct version without manual updates.https://github.com/CodeScapes-dev/k8lens-app.TELEMETRY_HMAC_SECRETrestored as a build-arg with# check=skipdirectives for intentional inline secret baking.CONTRIBUTING.mdadded with setup, branch workflow, PR conventions, and telemetry env var documentation.