Phase 4: SSO scaffolding, RBAC enforcement, tenant-scoped dashboards, audit logging, K8s deployment

RBAC (api/internal/authz) is live on /query and /dashboards, backed by a new enterprise/ module (session issuance, audit logging, RBAC storage, OIDC/SAML protocol wiring) that core never imports -- only calls over HTTP. Found and fixed a real cross-tenant vulnerability in dashboards (no tenant_id filtering at all) while writing the threat model doc. Two things are explicitly NOT done, documented rather than hidden: tenant isolation for log data itself (/query still shares one ClickHouse connection and Tantivy index across every tenant -- RBAC controls who can query, not what a query can see), and human SSO login (protocol wiring exists, no HTTP handler calls it yet). See docs/security/threat-model.md and docs/phase-4-runbook.md. Also adds deploy/ (Go Operator + Helm chart, validated offline only -- no cluster was reachable in this environment).
2026-08-13 22:16:59 -07:00
parent 9435115ab7
commit 3eb0f4c589
116 changed files with 8589 additions and 126 deletions
@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .Release.Name }}-alerting
+  labels:
+    {{- include "sentry.labels" . | nindent 4 }}
+    {{- include "sentry.selectorLabels" (list $ "alerting") | nindent 4 }}
+spec:
+  # See values.yaml's comment: replicas is not a real knob here yet.
+  replicas: {{ .Values.alerting.replicas }}
+  selector:
+    matchLabels:
+      {{- include "sentry.selectorLabels" (list $ "alerting") | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "sentry.selectorLabels" (list $ "alerting") | nindent 8 }}
+    spec:
+      initContainers:
+        {{- include "sentry.waitForTCP" (list "postgres" (printf "%s-postgres" .Release.Name) "5432") | nindent 8 }}
+        {{- include "sentry.waitForTCP" (list "api" (printf "%s-api" .Release.Name) "8080") | nindent 8 }}
+      containers:
+        - name: alerting
+          image: "{{ .Values.alerting.image.repository }}:{{ .Values.alerting.image.tag }}"
+          imagePullPolicy: {{ .Values.global.imagePullPolicy }}
+          env:
+            - name: POSTGRES_ADDR
+              value: "{{ .Release.Name }}-postgres:5432"
+            - name: POSTGRES_DATABASE
+              value: sentry_metadata
+            - name: POSTGRES_USERNAME
+              value: sentry
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Release.Name }}-postgres
+                  key: password
+            - name: API_QUERY_URL
+              value: "http://{{ .Release.Name }}-api:8080"
+            {{- if .Values.enterprise.enabled }}
+            # RoleService credential for POST /query, once api's
+            # ENTERPRISE_AUTH_URL enforcement is on -- see
+            # /docs/phase-4-isolation-design.md's alerting<->api gap and
+            # alerting/internal/queryclient's doc comment. NOT generated
+            # by this chart: mint one with
+            # `enterprise-auth -mint-service-token=alerting` (see
+            # enterprise/README.md) and supply it via
+            # --set-string alerting.apiServiceToken=... or a values
+            # override backed by a Secret you manage -- a chart
+            # generating its own long-lived service credential and
+            # storing it in the same release's values would defeat the
+            # point of it being a distinct, revocable credential.
+            {{- if .Values.alerting.apiServiceToken }}
+            - name: API_SERVICE_TOKEN
+              value: {{ .Values.alerting.apiServiceToken | quote }}
+            {{- end }}
+            {{- end }}
+          ports:
+            - name: http
+              containerPort: 8081
+          readinessProbe:
+            exec:
+              command: ["/alerting", "-healthcheck"]
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          resources:
+            {{- toYaml .Values.alerting.resources | nindent 12 }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .Release.Name }}-alerting
+  labels:
+    {{- include "sentry.labels" . | nindent 4 }}
+    {{- include "sentry.selectorLabels" (list $ "alerting") | nindent 4 }}
+spec:
+  selector:
+    {{- include "sentry.selectorLabels" (list $ "alerting") | nindent 4 }}
+  ports:
+    - name: http
+      port: 8081