91 lines
5.2 KiB
Markdown
91 lines
5.2 KiB
Markdown
<!-- m-wiki: type=concept slug=security-overview topic=security base-sha=d6708eca4236 generated-at=2026-05-12T12:00:00+00:00 sources=[docs/SECURITY.md] -->
|
||
|
||
> Generated 2026-05-12 at base-sha d6708eca4236. Type: concept. 1 source.
|
||
|
||
# Security Overview
|
||
|
||
devops-lib is a Jenkins Shared Library — not a web service. It has no HTTP endpoints, no user-facing auth, and no persistent storage. Security properties concern how secrets are handled, what trust boundaries exist, and what rules new code must follow.
|
||
|
||
## Trust boundaries
|
||
|
||
### Build trigger gate
|
||
|
||
Every build is hard-rejected unless triggered by one of:
|
||
- `ringmaster-bot` — Ringmaster's automated trigger
|
||
- `turbo-turtle` — Turbo-Turtle's CI callback trigger
|
||
- A hardcoded `allowedUsers` list of DevOps engineer email addresses
|
||
|
||
The gate runs at `vars/eksCICD.groovy:call` before any pipeline logic. There is no warning mode — unauthorized triggers abort immediately.
|
||
|
||
### Supply chain boundary (highest risk)
|
||
|
||
`devops-lib@main` is loaded via `@Library('devops-lib@main')` by every Meesho microservice on every build. **A malicious or buggy merge to `main` affects all 100+ consumer services' CI/CD pipelines.** Any change to `vars/eksCICD.groovy` or `src/com/meesho/utilities/constructParam.groovy` must be treated as Tier-1 code — these files control every build.
|
||
|
||
### Whitelist repo boundary
|
||
|
||
Policy exceptions (sonar skip, multizone, AppConfig, CAC) are fetched from `Meesho/whitelists` at build time via the `cicd-github-app` credential. If the whitelist repo is compromised, an attacker could grant or revoke policy exceptions for any service. See [ADR-0003](../adr/adr-index.md) for why exceptions live in a separate repo.
|
||
|
||
## Credential handling
|
||
|
||
All secrets are injected via Jenkins `withCredentials` — never hardcoded, never in `env.*` beyond the immediate operation:
|
||
|
||
| Credential ID | Used for |
|
||
|---|---|
|
||
| `cicd-github-app` | Cloning `Meesho/whitelists`, `devops-argo-config`, `devops-helm-charts` |
|
||
| `svc-devops-meesho` | GitHub API, JFrog Artifactory |
|
||
| `ringmaster-token` | Ringmaster callback API |
|
||
| `argocd-{bu}-prd-creds` / `argocd-dev-creds` | ArgoCD CLI login |
|
||
| `vault-prd-token` / `vault-dev-token` | Vault secret fetch |
|
||
| `sonar-token-prod` / `sonar-token-{bu}-dev` | SonarQube analysis |
|
||
|
||
**`set +x` guard**: `deployArgoCD.groovy:493` uses `set +x` before any `sh()` that includes a credential argument. Without this, Jenkins echoes the full shell command — including the credential value — to the build log.
|
||
|
||
**Vault token lifecycle**: `env.VAULT_TOKEN` is set temporarily at `src/com/meesho/stages/buildNode.groovy:548–553` and cleared immediately after the Vault fetch completes. It is not stored beyond the immediate use.
|
||
|
||
## Outbound calls
|
||
|
||
All external calls go FROM Jenkins agents TO external services. Protocol classification:
|
||
|
||
| Service | Protocol | Risk |
|
||
|---|---|---|
|
||
| ArgoCD | HTTPS + gRPC | Low — `set +x` guards password |
|
||
| Ringmaster | HTTPS | Low — auth via `ringmaster-token` |
|
||
| SonarQube, Vault, GitHub | HTTPS | Low |
|
||
| Turbo-Turtle, Deployment Tracker | **HTTP** (plain) | Low — internal VPC, accepted risk |
|
||
| Security scanner (`172.31.5.29:63232`) | **HTTP** (plain) | Low — internal, hardcoded IP |
|
||
|
||
## Security rules for new code
|
||
|
||
1. **Credentials**: Use `withCredentials` only. Never assign credential values outside a `withCredentials` block. Never interpolate credentials into log statements.
|
||
2. **Shell guard**: Use `set +x` before any `sh()` that includes a credential as an argument.
|
||
3. **Policy enforcement**: Never add inline repo-level policy exceptions — all exceptions go through `Meesho/whitelists` (see [ADR-0003](../adr/adr-index.md)).
|
||
4. **Supply chain hygiene**: Extra scrutiny for `vars/eksCICD.groovy` and `src/com/meesho/utilities/constructParam.groovy` — changes affect every Meesho microservice build.
|
||
5. **DinD image**: Must use the internal GAR-hosted DinD image, not Docker Hub `docker:N-dind`.
|
||
|
||
## Data classification
|
||
|
||
devops-lib handles no end-user PII. All data is build metadata (repo name, image tag, environment, team). Credential values are never logged.
|
||
|
||
## Known security debt
|
||
|
||
| ID | Gap | Severity |
|
||
|---|---|---|
|
||
| SEC-DL-001 | `allowedUsers` list has no expiry — stale access risk for departed engineers | Low |
|
||
| SEC-DL-002 | No `.github/CODEOWNERS` — supply chain protection depends on repo settings not auditable from source | Medium |
|
||
| SEC-DL-003 | Security scanner endpoint hardcoded as `172.31.5.29:63232` — silent failure if IP changes | Low |
|
||
| SEC-DL-004 | `env.VAULT_TOKEN` briefly in Jenkins serialized state during fetch | Low |
|
||
| SEC-DL-005 | Turbo-Turtle and Deployment Tracker callbacks over plain HTTP | Low |
|
||
|
||
Full details: [`docs/SECURITY.md`](../../../SECURITY.md)
|
||
|
||
## Related concepts
|
||
|
||
- [ADR index](../adr/adr-index.md) — architectural decisions that drive security properties (ADR-0003, ADR-0004, ADR-0006)
|
||
- [Whitelist system](../policy/whitelist-system.md) — policy exception enforcement
|
||
- [Ringmaster integration](../deploy/ringmaster-integration.md) — trigger gate flow
|
||
- [Config and Policy](../06-CONFIG-POLICY.md) — constructParam and credential injection
|
||
|
||
## Notes
|
||
|
||
<!-- Anything below is human-owned. wiki-init never reads or modifies content under this heading. -->
|