This file is read by automated agents (security scanners, code analyzers, AI assistants) operating on this repository. It points them at the human-authored references they should consult before producing output.
This repository inherits the Apache APISIX project threat model. The authoritative document lives at:
https://github.com/apache/apisix/blob/master/docs/en/latest/security-threat-model.md
The §4.2 component-family table in that document covers this
repository under the apisix-ingress-controller family.
Of particular relevance to this controller specifically: §4.8
includes a CRD-to-Admin-API fidelity invariant — silent drop,
injection, or rename between the Kubernetes apisix.apache.org
CRD spec and the Admin API target is a controller bug, not
operator misconfiguration. The §4.8 entry recommends an e2e
contract test enforcing this invariant.