CVE-2025-32963

@@ -2,15 +2,10 @@
 
 Each example in this folder contains an example using a different SDK on how to adopt Operator's STS.
 
-> ⚠️ This feature is an Beta release now starting Operator v6.x, Operator v5.x released STS as v1alpha1.
+> ⚠️ This feature is on v1beta1 starting Operator v6.x, Operator v5.x released STS as v1alpha1.
 
 # Requirements
 
-## Enabling STS functionality
-
-At the moment, the STS feature ships off by default, to turn it on switch `OPERATOR_STS_ENABLED` to `on` on
-the `minio-operator` deployment.
-
 ## TLS
 
 The STS functionality works only with TLS configured. We can request certificates automatically, but additional you can
@@ -21,14 +16,6 @@ use `cert-manager` or bring your own certificates.
 To install the example, you need an existing tenant, optionally, you can install the `tenant-lite` example, or
 the `tenant-certmanager` example
 
-# 0. Enable STS Functionality
-
-If you haven't done so, enable the STS feature on operator by turning setting the feature flag `OPERATOR_STS_ENABLED=on`
-
-```shell
-kubectl -n minio-operator set env deployment/minio-operator OPERATOR_STS_ENABLED=on
-```
-
 # 1. Install Tenant (Optional)
 
 ```shell
@@ -114,4 +101,9 @@ kubectl apply -k examples/kustomization/sts-example/sample-clients/minio-sdk/jav
 
 ```shell
 kubectl apply -k examples/kustomization/sts-example/sample-clients/minio-sdk/dotnet
-```
\ No newline at end of file
+```
+
+## Disabling STS functionality
+
+MinIO Operator is shipped with STS feature on by default, if you want to disable this feature set `OPERATOR_STS_ENABLED` to `off` on
+the `minio-operator` deployment.

@@ -2,4 +2,5 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   namespace: minio-tenant-1
-  name: mc-job-sa
\ No newline at end of file
+  name: mc-job-sa
+automountServiceAccountToken: false
\ No newline at end of file

@@ -42,17 +42,37 @@ spec:
           configMap:
             name: start-config-script
             defaultMode: 0744
+        - name: sa-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  audience: "sts.min.io"
+                  expirationSeconds: 3600
+                  path: token
+        - name: root-ca
+          configMap:
+            name: kube-root-ca.crt
+            items:
+              - key: ca.crt
+                path: ca.crt
+            defaultMode: 0644
       containers:
         - name: mc
           image: minio/mc
           command: [ "/start-config/setup.sh" ]
           volumeMounts:
             - name: start-config
               mountPath: /start-config/
+            - name: sa-token
+              mountPath: /var/run/secrets/sts.min.io/serviceaccount
+              readOnly: true
+            - name: root-ca
+              mountPath: /root/.mc/certs/CAs/
+              subPath: ca.crt
           env:
             - name: MC_HOST_myminio
               value: https://$(ACCESS_KEY):$(SECRET_KEY)@minio.minio-tenant-1.svc.cluster.local
             - name: MC_STS_ENDPOINT_myminio
               value: https://sts.minio-operator.svc.cluster.local:4223/sts/minio-tenant-1
             - name: MC_WEB_IDENTITY_TOKEN_FILE_myminio
-              value: /var/run/secrets/kubernetes.io/serviceaccount/token
+              value: /var/run/secrets/sts.min.io/serviceaccount/token

@@ -8,6 +8,7 @@ kind: ServiceAccount
 metadata:
   namespace: sts-client
   name: stsclient-sa
+automountServiceAccountToken: false
 ---
 apiVersion: v1
 kind: Secret
@@ -53,7 +54,7 @@ spec:
       serviceAccount: stsclient-sa
       containers:
         - name: sts-client
-          image: miniodev/operator-sts-example:minio-go
+          image: miniodev/operator-sts-example:minio-sdk-go
           imagePullPolicy: IfNotPresent
           env:
             - name: MINIO_ENDPOINT
@@ -65,7 +66,7 @@ spec:
             - name: BUCKET
               value: test-bucket
             - name: AWS_WEB_IDENTITY_TOKEN_FILE
-              value: /var/run/secrets/kubernetes.io/serviceaccount/token
+              value: /var/run/secrets/sts.min.io/serviceaccount/token
             - name: STS_POLICY
               value: /tmp/policy.json
             - name: STS_CA_PATH # When Certmanager is used will load the ca in this file
@@ -78,6 +79,9 @@ spec:
               subPath: policy.json
             - name: tenant-certmanager-tls
               mountPath: /var/run/secrets/sts.min.io/
+            - name: sa-token
+              mountPath: /var/run/secrets/sts.min.io/serviceaccount
+              readOnly: true
       volumes:
         - name: sts-policy
           configMap:
@@ -92,3 +96,10 @@ spec:
                   items:
                     - key: ca.crt
                       path: ca.crt
+        - name: sa-token
+          projected:
+            sources:
+              - serviceAccountToken:
+                  audience: "sts.min.io"
+                  expirationSeconds: 3600
+                  path: token

@@ -39,6 +39,11 @@ const (
 	STSEndpoint        = "/sts"
 )
 
+const (
+	// TokenReviewAudience is the audience for the token review request
+	TokenReviewAudience = "sts.min.io"
+)
+
 const (
 	// STSEnabled Env variable name to turn on and off the STS Service is enabled, disabled by default
 	STSEnabled = "OPERATOR_STS_ENABLED"
@@ -380,7 +385,8 @@ func getTenantClient(ctx context.Context, c *Controller, tenant *miniov2.Tenant)
 func (c *Controller) ValidateServiceAccountJWT(ctx *context.Context, token string) (*authv1.TokenReview, error) {
 	tr := authv1.TokenReview{
 		Spec: authv1.TokenReviewSpec{
-			Token: token,
+			Token:     token,
+			Audiences: []string{TokenReviewAudience},
 		},
 	}
 

@@ -116,10 +116,23 @@ func (c *Controller) AssumeRoleWithWebIdentityHandler(w http.ResponseWriter, r *
 		return
 	}
 
+	isSSTSAudience := false
+	for _, audience := range saAuthResult.Status.Audiences {
+		if audience == TokenReviewAudience {
+			isSSTSAudience = true
+		}
+	}
+
+	if !isSSTSAudience {
+		writeSTSErrorResponse(w, true, ErrSTSAccessDenied, fmt.Errorf("Access denied: Invalid Token, audience '%s' not found", TokenReviewAudience))
+		return
+	}
+
 	if !saAuthResult.Status.Authenticated {
 		writeSTSErrorResponse(w, true, ErrSTSAccessDenied, fmt.Errorf("Access denied: Invalid Token"))
 		return
 	}
+
 	chunks := strings.Split(strings.Replace(saAuthResult.Status.User.Username, "system:serviceaccount:", "", -1), ":")
 
 	if len(chunks) < 2 {