validate_dnssec_key_secret_name

bindy::safe_volume

Function validate_dnssec_key_secret_name 

Source 
pub fn validate_dnssec_key_secret_name(
    name: &str,
) -> Result<(), VolumeRejection>
Expand description

Validate that a user-supplied DNSSEC key Secret name obeys the same name-prefix allow-list as user secret: volumes.

spec.dnssec.signing.keysFrom.secretRef is mounted into the operand Pod outside the normal spec.volumes path, so without this check a tenant can mount an arbitrary Secret in the namespace (e.g. another tenant’s RNDC/TSIG key), bypassing both validate_user_volumes and the pod-shape admission policy. Closes audit finding H2.

§Errors

Returns VolumeRejection::DnssecKeySecretPrefix if name does not start with crate::constants::ALLOWED_USER_SECRET_PREFIX.