Security Overview

Testudo is a control-plane system that accesses the management cluster, remote business clusters, object storage, and backup data. Treat it as part of the platform security baseline, not as a regular web application.

Security Boundaries

Boundary	Default Behavior	Risk
Web console	disaster-web exposed through NodePort 30087	Do not expose directly to the public internet
Server API	disaster-server is ClusterIP 30081	Avoid exposing it directly outside the cluster
Operator	Runs in the management cluster and accesses CRDs, Velero, and remote cluster credentials	Over-broad permissions increase blast radius
Webhook	Enabled by default, service port 443 to target 9443	Incorrect TLS/CA breaks CRD writes
Object storage	Stores backup artifacts	Credential leakage can expose or delete backups
Remote cluster credentials	kubeconfig or token+endpoint	Use least privilege and rotate credentials

Authentication And Entry Points

• /login and /refresh_token are public authentication endpoints.
• Business APIs under /apis and /api use JWT middleware outside dev mode.
• Watch/WebSocket clients can pass tokens through Authorization, Sec-WebSocket-Protocol, or the token query parameter.
• OpenAPI routes are registered as /openapi.yaml, /openapi.json, and /swagger/ when Swagger is enabled.

See API Authentication.

Permission Principles

• Server should not bypass the CRD state machine to change remote business resources directly.
• Operator owns actions that change disaster recovery runtime state.
• Remote cluster credentials should only grant permissions required for backup, restore, and protected namespaces.
• Production deployments should regularly audit ServiceAccounts, ClusterRoleBindings, and Secrets in the management cluster.

See RBAC and Permissions.

Credential Governance

Protect:

• Image pull secrets.
• Object storage access keys.
• Remote cluster kubeconfig or tokens.
• JWT secret.
• License Secret.
• Webhook TLS Secret and CA bundle.

Do not commit real credentials to public repositories or public values files. Open-source release packages should use placeholders or existing Secrets.

See Secrets and Credentials.

Network Guidance

• Prefer Ingress, gateway, or controlled operations entry points for disaster-web.
• Keep disaster-server as ClusterIP; only allow web, gateway, or approved automation systems to access it.
• Protect operator metrics with Kubernetes RBAC and network policy when enabled.
• Explicitly define firewall rules from the management cluster to remote Kubernetes APIs and object storage endpoints.

See Network and Ports.

Vulnerability Reporting

Report security vulnerabilities through GitHub Security Advisories. Do not disclose suspected vulnerabilities in public issues:

• Operator: https://github.com/softcdata/testudo-operator/security/advisories/new
• Server: https://github.com/softcdata/testudo-server/security/advisories/new