Skip to content
Eddy

Security model

A short version of the security model. The full reasoning and threat model are in docs/security.md and the ADRs. To report a vulnerability, see SECURITY.md.

Full reference: docs/security.md in the repository.

The short version

  • Agents only dial out. Workload API servers are never exposed, and the hub holds no credentials for any workload cluster.
  • Kubernetes RBAC is the only permission model. Every direct read (YAML, events, logs) and every write is impersonated as the signed-in person. Lists and counts from the agent's cache are filtered per user with SubjectAccessReviews before they leave the hub.
  • Agents have no write access of their own. Their ServiceAccount is read-only, apart from impersonate and SubjectAccessReviews.
  • No Secret or ConfigMap data leaves a cluster. Agents send summaries only.
  • Ask AI is read-only. Everything the AI or an MCP client sees is filtered by the asking user's RBAC and redacted first.

Impersonation

Users appear in the cluster as local:<username>, their verified GitHub email (or github:<login>), the OIDC usernameClaim, or the proxy identity, with groups prefixed eddy:. system:* users and groups are never impersonated. The cluster's own audit log records the real user. A compromised hub cannot reach any cluster directly, and the damage is bounded by the RBAC you granted to eddy: groups.

Signing in and tokens

  • v1.0 supports GitHub and OIDC sign-in (Google, Okta, Entra, Dex), local users (argon2id) and trusted reverse-proxy headers. SAML 2.0 is a possible future addition. See Sign-in.
  • Sessions are server-side behind a __Host- cookie, with CSRF protection and a strict CSP.
  • Personal access tokens (eddy_pat_…) work only as a bearer token on /mcp, are stored hashed, expire, and are revocable.

AI and MCP

  • Ask AI has no write tools. Cluster data is wrapped as untrusted content and output is redacted.
  • Bedrock keeps data in your AWS account and region. The Anthropic API sends data to Anthropic, and the UI shows which provider is in use.
  • MCP writes need the operate scope and confirm_cluster on protected clusters. Operators can switch AI, MCP or MCP writes off at runtime with the eddy-runtime ConfigMap.

Hardening checklist

  • Set publicURL to the real https origin.
  • Keep the UI and agent ingress internal and restrict source CIDRs.
  • Encrypt the PostgreSQL storage and its backups.
  • Pin agent impersonation with impersonation.groups and keep the agent NetworkPolicy on.
  • Keep mcp.allowLogs and ai.allowLogs off unless you need them.
  • Mark production clusters protected: true.
  • Grant eddy: groups only the RBAC people should have.