Security¶

This page describes the security controls built into DroidFarm. Each section covers a specific concern area and what the system does to address it.

RBAC¶

The operator service account uses a split RBAC model to limit blast radius:

• A lean ClusterRole (*-operator-cluster) covers only genuinely cluster-scoped resources: custom resource types under droidfarm.io and nodes (read-only).
• A namespace-scoped Role (*-operator) in the operator's own namespace covers pods (no exec), services, configmaps, secrets (no delete), events, gateway.networking.k8s.io HTTPRoutes, jobs, and leases. The Gateway itself is owned by the cluster operator (the shared Cilium Gateway in kube-system, or a dedicated chart-rendered Gateway if streaming.gateway.enabled=true); the DroidFarm operator only writes per-device HTTPRoute objects in its own namespace.
• Both are bound to the same service account via a ClusterRoleBinding and a RoleBinding respectively.

pods/exec is absent from both roles — the operator drives devices through the Appium sidecar, not direct exec.

Operator Pod Security¶

The operator pod runs with a hardened security context:

Emulator Pod Capabilities¶

Emulator pods require elevated capabilities to run the Cuttlefish hypervisor. No --privileged mode is used. The pod runs with:

• NET_ADMIN — manage network interfaces inside the container
• NET_RAW — raw socket access for Cuttlefish networking
• SYS_ADMIN — mount and cgroup operations inside the VM

The default cuttlefish-qemu backend does not require any device plugin. No host devices are mapped and no privileged DaemonSet is needed.

When using the optional cuttlefish (KVM) backend, device access is granted via the squat/generic-device-plugin DaemonSet using Kubernetes resource limits (squat.ai/kvm: "1", squat.ai/vhost: "3"), keeping /dev/kvm and related devices off the host filesystem path. That DaemonSet runs with securityContext.privileged: true — this is an unavoidable requirement of the Kubernetes Device Plugin API (the same pattern used by NVIDIA and AMD GPU plugins). Its blast radius is limited by a nodeSelector restricting it to KVM-capable nodes and by the absence of any RBAC bindings.

CRD Input Validation¶

User-controlled string fields that flow into shell commands are validated at the Kubernetes API level via OpenAPI schema constraints in the CRD manifests:

The CEL validation rule on extraProperties requires Kubernetes 1.25+ (CustomResourceValidationExpressions feature gate, GA in 1.29). On older clusters, remove the x-kubernetes-validations block and rely on the pattern/maxLength constraints alone.

TURN Credentials¶

TURN credentials for coturn are stored in a Kubernetes Secret object (coturn-secret.yaml), not in values.yaml.

• turn.credentials.createSecret: true creates the Secret from values passed via --set at install time.
• turn.credentials.existingSecret accepts the name of a Secret provisioned out-of-band (Vault, External Secrets Operator, Sealed Secrets) for production environments.
• Credentials are injected into the coturn container via secretKeyRef environment variables (COTURN_USERNAME, COTURN_PASSWORD) and passed as --user=$(COTURN_USERNAME):$(COTURN_PASSWORD). Kubernetes performs variable substitution at the kubelet level, keeping credentials out of visible argument strings.

Never commit TURN credentials to values files or GitOps repositories. Use --set or an encrypted values overlay (SOPS + age, Helm Secrets).

Per-Device HTTPRoute Edge Boundary¶

The per-device HTTPRoute is the auth boundary between the public internet and a single emulator. The cluster's shared Cilium Gateway (kube-system/cilium-gateway, listener section https) terminates TLS; each device is then exposed only via one HTTPRoute (<pool>-device-<ordinal>) that matches a specific hostname <pool>-<ordinal>.<streaming.domain> and forwards exclusively to that device's Service.

Authentication itself is enforced by the layer in front of the Gateway (your IdP / OIDC proxy of choice). The point of the per-device route is to give that layer a stable per-device identifier — the hostname — to attach policy to.

Network Policies¶

Six NetworkPolicy objects segment traffic between components:

Tightening options:

• emulator-allow-ingress allows any cluster-internal source. Add a from.podSelector pointing at your CI runner or the Cilium gateway pods to restrict further.
• coturn-allow-egress is fully open, which is necessary for a TURN relay serving external peers. If all peers are cluster-internal, restrict to a podSelector.
• operator-allow-api-server allows egress to any IP on port 443. Pin to an ipBlock in clusters where the API server address is stable.

Residual Risks¶

Running a Security Scan¶

Scan the operator image for known CVEs:

trivy image ghcr.io/christopherime/droidfarm-operator:latest

Scan the rendered Helm chart manifests with kubesec:

helm template charts/droidfarm/ | kubesec scan /dev/stdin