[Functions] Context.getPulsarAdmin() may allow access to data from other tenants

[eolivelli]

Recently we introduced on master branch (2.8.0-SNAPSHOT) a new API Context.getPulsarAdmin() (and getPulsarAdmin(clustername)).

With this API the Function has access to the power of PulsarAdmin, but this is not restricted to the same "tenant" that is running the function.

We must limit the scope of this PulsarAdmin in order to be able to access only the resources of the same tenant.

Please note that this is still not a security issue report because Pulsar 2.8.0 has not been release yet.

[lhotari]

Changes were made in #9246 .

[eolivelli]

@freeznet @rdhabalia PTAL

[devinbost]

Looping in @merlimat since this is part of a larger discussion around the security of Context in Functions.

[merlimat]

Pulsar client admin is just a wrapper over the REST API. There's not anything that can be done with it that user wouldn't be able to do just connecting to the HTTP service and making calls.

The security of the Admin API service is done by ensuring the calls are made with valid credentials authorized to perform the specific operation. Functions/Connector instances will have to be provisioned with these credentials in order to be able to work, and these credentials will only allow certain operations.

[sijie]

Closed this ticket as there are no security concerns.