From dccc02dbfc18be6061bf7b55b7bbda8cd6540ca1 Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 20 Aug 2026 11:40:31 +0100 Subject: [PATCH 1/2] feat(charts): forbid access_tokens without posix-uid (except white-listed machine accounts) --- charts/workflows-cluster/values.yaml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/charts/workflows-cluster/values.yaml b/charts/workflows-cluster/values.yaml index 4f59cb7d1..f055dc946 100644 --- a/charts/workflows-cluster/values.yaml +++ b/charts/workflows-cluster/values.yaml @@ -269,6 +269,15 @@ authenticationConfiguration: ['k6Operator'].exists(allowed, allowed == claims.client_id) ) message: "Invalid access token (service account not on allowed-list). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" + - expression: > + claims.?posix_uid.hasValue() + || + ( + claims.?client_id.hasValue() + && + ['k6Operator'].exists(allowed, allowed == claims.client_id) + ) + message: "Invalid access token (missing posix-uid). See: https://diamondlightsource.github.io/workflows/docs/how-tos/authentication/" userValidationRules: - expression: "!user.username.startsWith('system:')" message: "username cannot use reserved system: prefix" From 4b097b5b0baeaf862354ccb29c57002e4cf1a48e Mon Sep 17 00:00:00 2001 From: David Hadley Date: Thu, 20 Aug 2026 13:15:09 +0100 Subject: [PATCH 2/2] chore(charts): update workflows-cluster chart version --- charts/workflows-cluster/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/workflows-cluster/Chart.yaml b/charts/workflows-cluster/Chart.yaml index edfa1edf4..f5b7f83bc 100644 --- a/charts/workflows-cluster/Chart.yaml +++ b/charts/workflows-cluster/Chart.yaml @@ -3,7 +3,7 @@ name: workflows-cluster description: A virtual cluster for Data Analysis workflows type: application -version: 0.13.24 +version: 0.13.25 dependencies: - name: common version: 2.23.0