🤖 CoderWorkspacePool Share mode: an idle-reaped workspace that the pool keeps stays shared without policy checks

Offen
  • Stimmt etwas nicht?
#451 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
18/100
Issue-Typ
Bug
Klarheit
Muss geklärt werden
Aktivitätsstatus
Aktiv
Tech-Stack
go, kubernetes
Bereich
authorization

Rechercherichtung

The release path is in internal/controller/coderworkspacepoolmember_cleanup.go, at the result.kept branch where the member keeps the workspace and drops its finalizer. The issue asks a maintainer to choose between removing the operator's ACL entry before release and keeping the share with documentation, so settle that first. Done means the chosen option is implemented or documented and a test covers a kept Share workspace after an idle reap.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Problem

With claims.idleTimeoutSeconds (#447), the pool deletes the member of an idle claim. Right before the delete build, the member reads the workspace once more. If that read shows a use after the pool's idle check, or no last_used_at, the member keeps the workspace in Coder and releases its finalizer (internal/controller/coderworkspacepoolmember_cleanup.go, the result.kept path). The claim is then Lost with IdleTimeout.

For a Share claim (#446), the kept workspace still lists the shared user in its ACL with use. After the release, no member checks the share policy for that workspace any more. If an admin later removes the user from the listed groups, empties shareGroupIDs, or suspends the user, nothing removes the share.

Found by the Codex security review of #446 (P2): https://github.com/coder/coder-k8s/pull/446#discussion_r4433862590

Impact

The user keeps the access that the policy granted before the release, on a workspace that the user was using a moment before. No data loss. The window to reach this path is short: a use between the pool's idle check and the member's last read. The same holds for other leftover workspaces, for example after a control plane delete (#448).

Design question

  1. Remove the operator's ACL entry before the release. Then policy withdrawal can no longer matter, but the shared user loses the way back to the kept work: #447's message tells the claimant that coder ssh <owner>/<workspace> still reaches a kept workspace, and for a Share claim that works only through the share. Coder also applies the removal only after a restart (#450).
  2. Keep the share, and document that a kept Share workspace stays shared and needs a manual coder sharing remove when the admin cleans up leftovers.

Refs #153.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh

Vorherrschende Sprache
Go
Sterne
5
Forks
3
Ø Merge
1 Std. 50 Min.
Gemergte PRs (30 T.)
160

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus coder/coder-k8s

Alle Issues in coder/coder-k8s

Ähnliche Issues

Weitere Issues zu Go

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.