security(unifi): Git source is an unverified moving branch feeding a credentialed network write

[devantler]

🤖 Generated by the Agentic Engineer

Evidence (verified live, 2026-08-08)

GitRepository/unifi in namespace unifi tracks ref.branch: main — a moving branch — and
carries verify: NONE. The consuming Kustomization/unifi is not suspended and is actively
reconciling (Applied revision: main@sha1:77dc6590…).

So the cluster continuously applies whatever appears on that branch's head, with no pin and no
signature check, into an app holding a write-scoped UniFi Cloud Connector credential.

Audience and impact

The affected surface is the deployed home network configuration — VLANs, firewall rules, SSIDs, device
and VPN config. An unreviewed or compromised push to the source branch reaches the network without a
verification step. This is the same class the platform already closes elsewhere: the root
OCIRepository is cosign-verified, and other sources are pinned. This one is the outlier.

Expected behaviour

The UniFi source is either pinned (spec.ref.tag or spec.ref.commit/digest) or
signature-verified (spec.verify), so a moving branch alone cannot reach the cluster — while
normal delivery keeps working.

Why not the existing mitigation

#2705 proposes suspend: true on the Kustomization. It closes the hole but stops delivery entirely,
so every legitimate change stops applying until someone unsuspends. It is a reasonable holding action
and it is why this issue exists, but the pin is strictly better: same floor, no friction. #2705 stays
parked as the fallback.

Acceptance criteria

• GitRepository/unifi either verifies signatures or pins to an immutable ref.
• Kustomization/unifi remains unsuspended and still reconciles after the change.
• Verified against the live cluster after deploy, not from the manifest alone — the reconciled
  revision must match the pinned/verified source.
• Whatever mechanism is chosen is consistent with how the platform's other verified sources are
  configured, rather than a one-off.
• fix(unifi): suspend Flux Kustomization for unsigned UniFi Git source #2705 closed unmerged once this lands.

Trade-off to decide while implementing

Pinning to a tag means UniFi changes need a tag bump to ship, which is friction on a repo the
maintainer edits directly. Signature verification keeps branch-tracking convenience and adds a signing
requirement instead. Prefer whichever matches existing practice in this repo; state the choice and its
everyday cost in the PR body per the two-sided hardening test.

Rough size: small — one resource, plus a live post-deploy check.

[coderabbitai]

🔗 Related PRs

#2319 - feat(security): cosign-verify the infrastructure Flux OCI artifact [merged]
#2816 - fix(security): reject floating workflow refs in cosign subject matchers [merged]
#2919 - fix(security): move Flux cosign verify to the path KSail reads [merged]
#2964 - fix(security): pin cosign subject refs at the image-verification layer [merged]
#3001 - fix(security): enforce cosign verify on the live root OCIRepository [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!