[SIG-Auth] Bi-Weekly Meeting for 2025-06-04

[The goal is to introduce a unified, analyzable conditional authorization system that improves security, simplifies policy writing, and enables fine-grained control over both read and write operations in Kubernetes clusters, using a subset of Cell/CRD expressions with SMT-based analyzability to prevent privilege escalation.]

• Unified authorization with label and field selectors for both read and write operations 17:18
• Conditional authorization enables partial evaluation and residual policy checks, allowing for safer, more consistent decisions at admission and authorization stages 22:00
• The proposed solution leverages Cedar’s analyzable SMT encoding to detect privilege escalation risks and ensure policy consistency without requiring full loops or complex expressions 28:45
• A key design choice is restricting expressions to avoid loops and quantifiers, ensuring analyzability while maintaining practical expressiveness for common use cases 30:00

This approach enables a consistent, user-friendly authorization experience across reads and writes, with built-in safety checks and backward compatibility, while leveraging existing tools like Cedar and proposing a forward-compatible implementation in the Kubernetes ecosystem.

Sources:

• 17:18 Discussion of unified policy targeting for both read and write operations
• 22:00 Explanation of partial evaluation and residual checks for policy safety
• 28:45 Overview of SMT-based analyzability and privilege escalation prevention
• 30:00 Rationale for restricting express