security: safe defaults and timeline hardening

Co-authored-by: Breee <11966385+Breee@users.noreply.github.com>

Author: Copilot

README.md

@@ -174,12 +174,14 @@ Timeline and tracing:
 ```text
 --timeline-bind-address=:8090
 --otel-otlp-endpoint=<collector-host:4317>
---otel-otlp-insecure=true
+--otel-otlp-insecure=false
 ```
 
-Timeline UI path: `/timeline/ui` — opens a compact cross-namespace overview (state-over-time swimlanes, color-coded event log, and a drag-to-zoom time ruler with a from/to picker).
-
-> **⚠ Experimental:** the timeline UI/API is unauthenticated and read-only. Use it only via localhost or `kubectl port-forward`; never expose it through an Ingress or untrusted network.
+The timeline server is **disabled by default**. Enable it only when you can
+restrict access to trusted networks, for example via `kubectl port-forward`.
+When enabled, the UI/API is unauthenticated and read-only at `/timeline/ui`; it
+exposes namespace names, workload names, and restart state, so never expose it
+through an Ingress or untrusted network.
 
 ## Security note
 

charts/kick/values.yaml

@@ -58,6 +58,9 @@ containerSecurityContext:
   capabilities:
     drop:
       - ALL
+  readOnlyRootFilesystem: true
+  seccompProfile:
+    type: RuntimeDefault
 
 probes:
   liveness:

cmd/main.go

@@ -69,10 +69,10 @@ func parseFlags() options {
 	var argocdApplicationNamespaces string
 	flag.StringVar(&opts.metricsAddr, "metrics-bind-address", ":8080", "Metrics endpoint address.")
 	flag.StringVar(&opts.probeAddr, "health-probe-bind-address", ":8081", "Health probe address.")
-	flag.StringVar(&opts.timelineAddr, "timeline-bind-address", ":8090", "Timeline API/UI bind address. Empty disables the timeline server.")
+	flag.StringVar(&opts.timelineAddr, "timeline-bind-address", "", "Timeline API/UI bind address. Empty disables the timeline server.")
 	flag.BoolVar(&opts.leaderElection, "leader-elect", false, "Enable leader election.")
 	flag.StringVar(&opts.otlpEndpoint, "otel-otlp-endpoint", "", "OTLP endpoint (host:port) for exporting traces to Tempo/Jaeger or another collector.")
-	flag.BoolVar(&opts.otlpInsecure, "otel-otlp-insecure", true, "Use insecure OTLP transport (no TLS).")
+	flag.BoolVar(&opts.otlpInsecure, "otel-otlp-insecure", false, "Use insecure OTLP transport (no TLS).")
 	flag.DurationVar(&opts.requestRetention, "request-retention", 24*time.Hour, "Retention duration for terminal KickRequests before deletion.")
 	flag.DurationVar(&opts.rolloutTimeout, "rollout-timeout", 15*time.Minute, "How long a restart may take before the KickRequest fails with RolloutTimeout.")
 	flag.BoolVar(&opts.enableCSIIntegration, "enable-csi-integration", false, "Watch SecretProviderClassPodStatus to restart workloads when Secrets Store CSI secrets rotate. Ignored when the CRD is absent.")

config/manager/manager.yaml

@@ -20,6 +20,9 @@ spec:
           allowPrivilegeEscalation: false
           capabilities: {drop: ["ALL"]}
           runAsNonRoot: true
+          readOnlyRootFilesystem: true
+          seccompProfile:
+            type: RuntimeDefault
         resources:
           requests: {cpu: 10m, memory: 64Mi}
           limits: {cpu: 500m, memory: 256Mi}

docs/content/docs/operations/security.md

@@ -12,4 +12,13 @@ KICK safety constraints:
 
 - no privileged containers;
 - no CRI socket access;
-- no Secret value logging.
+- no Secret value logging;
+- container runs with a read-only root filesystem and the runtime default seccomp profile.
+
+## Timeline UI
+
+The timeline server is disabled by default. Enable it with `--timeline-bind-address` only on trusted networks, for example via `kubectl port-forward`. It is unauthenticated and exposes namespace names, workload names, and restart state.
+
+## Tracing
+
+OTLP trace export defaults to TLS. Use `--otel-otlp-insecure` only when the collector is reached through a trusted, encrypted path such as a service mesh.

internal/timeline/service.go

@@ -19,6 +19,7 @@ import (
 	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/types"
 	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
 type Entry struct {
@@ -122,6 +123,11 @@ type Service struct {
 	ObservationStore observation.Store
 }
 
+const (
+	msgInternalServerError = "internal server error"
+	msgBadRequest          = "bad request"
+)
+
 func RegisterHandlers(mux *http.ServeMux, svc *Service) {
 	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/" {
@@ -139,11 +145,23 @@ func RegisterHandlers(mux *http.ServeMux, svc *Service) {
 	mux.HandleFunc("/timeline/ui", serveUI)
 }
 
+// writeError logs the full error and returns a generic message to the client.
+// Timeline endpoints are exposed without authentication, so internal details
+// must not leak through HTTP responses.
+func (s *Service) writeError(ctx context.Context, w http.ResponseWriter, err error, code int) {
+	log.FromContext(ctx).Error(err, "timeline request failed")
+	msg := msgInternalServerError
+	if code == http.StatusBadRequest {
+		msg = msgBadRequest
+	}
+	http.Error(w, msg, code)
+}
+
 func (s *Service) handleNamespaces(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	var namespaces corev1.NamespaceList
 	if err := s.Client.List(ctx, &namespaces); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 
@@ -168,7 +186,7 @@ func (s *Service) handleResources(w http.ResponseWriter, r *http.Request) {
 
 	var policyList kickv1alpha1.KickPolicyList
 	if err := s.Client.List(ctx, &policyList, listOptions...); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 	policies := make([]KickPolicySummary, 0, len(policyList.Items))
@@ -184,7 +202,7 @@ func (s *Service) handleResources(w http.ResponseWriter, r *http.Request) {
 
 	var requestList kickv1alpha1.KickRequestList
 	if err := s.Client.List(ctx, &requestList, listOptions...); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 	requests := make([]KickRequestSummary, 0, len(requestList.Items))
@@ -230,7 +248,7 @@ func (s *Service) handleTimeline(w http.ResponseWriter, r *http.Request) {
 
 	items, err := s.buildTimeline(ctx, namespace, kind, name)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 
@@ -239,15 +257,16 @@ func (s *Service) handleTimeline(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Service) handleDiscovery(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	namespace := r.URL.Query().Get("namespace")
 	if namespace == "" {
 		http.Error(w, "namespace is required", http.StatusBadRequest)
 		return
 	}
 
-	items, policies, err := s.discoverManagedWorkloads(r.Context(), namespace)
+	items, policies, err := s.discoverManagedWorkloads(ctx, namespace)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 
@@ -274,15 +293,16 @@ func (s *Service) handleDiscovery(w http.ResponseWriter, r *http.Request) {
 }
 
 func (s *Service) handleDAG(w http.ResponseWriter, r *http.Request) {
+	ctx := r.Context()
 	namespace := r.URL.Query().Get("namespace")
 	if namespace == "" {
 		http.Error(w, "namespace is required", http.StatusBadRequest)
 		return
 	}
 
-	dag, err := s.buildDAG(r.Context(), namespace)
+	dag, err := s.buildDAG(ctx, namespace)
 	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 
@@ -298,7 +318,7 @@ func (s *Service) handleOverview(w http.ResponseWriter, r *http.Request) {
 
 	var namespaces corev1.NamespaceList
 	if err := s.Client.List(ctx, &namespaces); err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
+		s.writeError(ctx, w, err, http.StatusInternalServerError)
 		return
 	}
 

internal/timeline/service_test.go

@@ -3,8 +3,10 @@ package timeline
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 
@@ -15,6 +17,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/client/fake"
 )
 
@@ -418,3 +421,60 @@ func TestHandleOverviewAggregatesAcrossNamespaces(t *testing.T) {
 		}
 	}
 }
+
+// errorClient is a fake client that fails every List with a fixed error.
+type errorClient struct {
+	client.Client
+	err error
+}
+
+func (c *errorClient) List(ctx context.Context, list client.ObjectList, opts ...client.ListOption) error {
+	return c.err
+}
+
+// TestTimelineHandlersDoNotLeakInternalErrors verifies that the read-only
+// timeline API returns generic error messages instead of raw API-server errors.
+func TestTimelineHandlersDoNotLeakInternalErrors(t *testing.T) {
+	scheme := runtime.NewScheme()
+	if err := clientgoscheme.AddToScheme(scheme); err != nil {
+		t.Fatalf("add kube scheme: %v", err)
+	}
+	if err := kickv1alpha1.AddToScheme(scheme); err != nil {
+		t.Fatalf("add kick scheme: %v", err)
+	}
+
+	inner := fake.NewClientBuilder().WithScheme(scheme).Build()
+	svc := &Service{Client: &errorClient{Client: inner, err: errors.New("etcd is unavailable: internal cluster detail")}, ObservationStore: observation.NewMemoryStore()}
+	mux := http.NewServeMux()
+	RegisterHandlers(mux, svc)
+
+	cases := []struct {
+		path string
+	}{
+		{"/timeline/namespaces"},
+		{"/timeline/resources?namespace=team-a"},
+		{"/timeline/discovery?namespace=team-a"},
+		{"/timeline/dag?namespace=team-a"},
+		{"/timeline/overview"},
+		{"/timeline?namespace=team-a&name=web"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.path, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "http://localhost"+tc.path, nil)
+			rr := httptest.NewRecorder()
+			mux.ServeHTTP(rr, req)
+
+			if rr.Code != http.StatusInternalServerError {
+				t.Fatalf("expected 500, got %d", rr.Code)
+			}
+			body := strings.TrimSpace(rr.Body.String())
+			if strings.Contains(body, "etcd") || strings.Contains(body, "internal cluster detail") {
+				t.Fatalf("response leaks internal error: %q", body)
+			}
+			if !strings.Contains(body, "internal server error") {
+				t.Fatalf("response missing generic message: %q", body)
+			}
+		})
+	}
+}