[Security/MSA] Authenticate CDC control-plane endpoints independently of gateway routing

[seonghobae]

Enterprise security gap

Protected develop@622e5e6c3d534f230c390f10e3832efadfc01825 exposes a CDC HTTP control plane under /api/cdc/** with mutating POST /start and POST /stop plus operational status/source/target inventory. A fresh source search finds no CDC SecurityFilterChain or Spring Security dependency, while local Compose publishes CDC port 8001 directly and gateway authentication is a separate active PR (#142).

The edge gateway therefore cannot be treated as the CDC service's authorization boundary: direct east-west/container/host access can reach CDC control endpoints without proving a caller identity. #180 can reduce accidental host exposure by loopback-binding the local stack, but network reachability is not application authorization.

RCA

• Immediate cause: CDC controller routes have no service-local authentication/authorization filter chain.
• Technical root cause: edge-routing authentication and direct service control-plane authority were conflated; CDC was built as if gateway topology alone were a trust boundary.
• Control failure: controller tests exercise functional start/stop/status behavior directly but no integration/security test proves unauthenticated callers are denied or that an authenticated workload/operator has the least privilege required for mutation versus observation.
• Architectural interaction: [Product/Security Gap] Replace direct ETL HTTP Basic trust boundary #161 identifies the analogous direct ETL trust-boundary problem. The correct durable design should share a reviewed service-identity/authentication contract where practical rather than creating mutually incompatible one-off mechanisms.

Distinct remediation options / feasibility

Preferred — common service identity / authorization contract

After #161 and deployment-identity evidence converge, use one versioned workload/operator identity boundary for ETL and CDC, with separate permissions for read-only status/catalog operations and lifecycle mutation. The deployment may provide JWT/OIDC workload identity, mTLS/service-mesh identity, or another reviewed mechanism; do not invent issuer URLs, secrets, certificates, users or a mesh in repository source.

Bounded standalone fallback

If an independently operable CDC service requires a credential-light local mode, make it explicit and local-only, while the deployable/default production profile fails closed without accepted identity configuration. A compatibility Basic-auth mode is acceptable only if its credential lifecycle and limitations are explicit; do not silently copy ETL's current Basic model as a permanent architecture.

Reject

• relying on gateway fix(gateway): replace placeholder token handling with JWT resource server #142 as proof that direct CDC requests are authorized;
• treating loopback/private networking as the sole production authorization mechanism;
• adding a hard-coded token, shared default password or committed key;
• allowing unauthenticated start/stop while protecting only read routes;
• inventing a caller-controlled X-Principal/X-Tenant header as identity;
• exposing detailed source/target/config inventory to unauthenticated callers merely because secrets are omitted.

Acceptance

1. fail-first runtime/security tests prove protected CDC control routes are currently reachable without authentication;
2. the selected deployable mode denies unauthenticated/invalid callers before controller mutation and does not leak which protected resource exists;
3. read-only status/catalog authority and lifecycle-mutation authority are least-privilege and separately testable where the selected identity model supports it;
4. direct service requests and gateway-routed requests bind to the same trusted caller/service identity semantics rather than trusting unsigned forwarding headers;
5. start/stop idempotency/concurrency and CDC stop must wait for graceful Debezium engine completion #141 graceful-stop semantics remain correct under authentication failures/retries;
6. ordinary denial diagnostics remain stable and credential/provider/exception-safe, consistent with fix(cdc): prevent replication probe diagnostic leakage #170–fix(etl): keep connector lifecycle diagnostics out of logs #176;
7. local Compose and production deployment profiles state their different trust assumptions explicitly; [Security/Deployment] Bind local Compose published ports to loopback by default #180 network exposure and this issue remain independent controls;
8. canonical PRD/TRD/Architecture/Security/Threat Model/UML/API/Operability/Traceability distinguish gateway edge auth, direct ETL auth ([Product/Security Gap] Replace direct ETL HTTP Basic trust boundary #161), CDC control auth, Eureka registry identity ([Security/MSA] Define authenticated service-registry authority for Eureka #185), and tenant authority ([Product/Data authority] Decide and enforce tenancy isolation model #186);
9. no new secret is requested until the selected failing boundary proves it is required and deployment ownership is known;
10. exact-source CI/security/non-vacuous coverage/review and protected-develop operational proof pass before the service is described as securely deployable.

Current classification

planned / known_gap. The common service-identity choice is an architecture dependency, so do not create a competing CDC security implementation while #161/#142 and deployment-identity work are unresolved. Repository-owned threat-model, API authority, local-profile and fail-closed tests can advance once a common identity contract is accepted.

Relationships: #142 gateway Resource Server; #161 direct ETL authentication; #180 local network exposure; #185 service registry identity; #186 tenancy authority; #141 graceful CDC stop.