Global GET /k8s/clusters exposes cross-project BNK membership to any viewer (S2)

[jgruberf5]

Cold-audit finding on PR #500 (ADR-424 Phase 1). Not a new bug — a widening of a pre-existing global-by-design endpoint.

GET /api/k8s/clusters (routes/k8s/clusters.py, dependencies=[Depends(require_viewer)], no project scope) calls list_all_clusters() and returns every cluster across all projects to any authenticated viewer. That was already true for cluster metadata. ADR-424 adds bnk_config to the serialized shape, so the global list now also exposes each cluster's host_ids, dpu_ids, control_plane_host_id, and tmfifo_pool_cidr cross-project.

If require_viewer is meant to be per-project rather than instance-global, this is cross-tenant info disclosure. Decide the intended tenancy model for the global list and, if needed, project-scope it (relates to the pre-existing KubernetesCluster scope sweep, #508).

Source: ADR-424 round-3 cold audit (rated SUGGESTION — pre-existing design).

---

_{Migrated from sp-prod-field/bnk-forge #511 (opened 2026-07-29; original labels: none). That repository is archived and read-only.
Bare #NNN references in the text above refer to issues and PRs in the original repository, not to numbering here.}

[github-actions]

Auto-closed by PR #174 ("Redact bnk_config from the instance-wide global cluster list") merged to staging. (Native Closes-#N only fires on the default branch; this Action covers staging.)

[jgruberf5]

Reopening — auto-closed in error by the staging merge of #174.

#174 landed as a partial hardening, not a full fix: it removes bnk_config from the instance-wide global list (GET /api/k8s/clusters), but the disclosure is still reachable in two requests, as surfaced in review:

1. The global list still returns each cluster's project_id.
2. GET /api/projects/{project_id}/k8s/clusters — require_viewer (any authenticated user), no membership/ownership check — then serves full bnk_config for any project_id supplied.

So any authenticated viewer can still read any project's bnk_config. The PR was deliberately reframed Relates to #116 for exactly this reason — but the first commit's message body still said Fixes #116, and the squash-merge concatenated it into the merge commit, so the auto-close Action closed this. My mistake: reframing the PR body isn't enough when a commit message carries the keyword.

What remains to close #116: enforce per-project membership on list_project_clusters (Option B) — mechanically small (require_cluster_owner/_check_ownership exist) but a real tenancy-model change (cross-project reads start returning 403), so it wants a product decision, like #103. The residual is documented in code at list_project_clusters. Leaving this open pending that call.