🤖 CoderWorkspacePool Share mode: an idle-reaped workspace that the pool keeps stays shared without policy checks

Aperta
  • Qualcosa non va?
#451 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
18/100
Tipo di issue
Bug
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
go, kubernetes
Ambito
authorization

Direzione di ricerca

The release path is in internal/controller/coderworkspacepoolmember_cleanup.go, at the result.kept branch where the member keeps the workspace and drops its finalizer. The issue asks a maintainer to choose between removing the operator's ACL entry before release and keeping the share with documentation, so settle that first. Done means the chosen option is implemented or documented and a test covers a kept Share workspace after an idle reap.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

With claims.idleTimeoutSeconds (#447), the pool deletes the member of an idle claim. Right before the delete build, the member reads the workspace once more. If that read shows a use after the pool's idle check, or no last_used_at, the member keeps the workspace in Coder and releases its finalizer (internal/controller/coderworkspacepoolmember_cleanup.go, the result.kept path). The claim is then Lost with IdleTimeout.

For a Share claim (#446), the kept workspace still lists the shared user in its ACL with use. After the release, no member checks the share policy for that workspace any more. If an admin later removes the user from the listed groups, empties shareGroupIDs, or suspends the user, nothing removes the share.

Found by the Codex security review of #446 (P2): https://github.com/coder/coder-k8s/pull/446#discussion_r4433862590

Impact

The user keeps the access that the policy granted before the release, on a workspace that the user was using a moment before. No data loss. The window to reach this path is short: a use between the pool's idle check and the member's last read. The same holds for other leftover workspaces, for example after a control plane delete (#448).

Design question

  1. Remove the operator's ACL entry before the release. Then policy withdrawal can no longer matter, but the shared user loses the way back to the kept work: #447's message tells the claimant that coder ssh <owner>/<workspace> still reaches a kept workspace, and for a Share claim that works only through the share. Coder also applies the removal only after a restart (#450).
  2. Keep the share, and document that a kept Share workspace stays shared and needs a manual coder sharing remove when the admin cleans up leftovers.

Refs #153.

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh

Lingua principale
Go
Stelle
5
Fork
3
Merge medio
1h 50m
PR unite (30g)
160

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di coder/coder-k8s

Tutte le issue di coder/coder-k8s

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.