Ownership proof for Coder IDs recorded in controller status (D11 B)

Aberta
  • Algo errado?
#372 0 comentários 0 reações 1 responsável Ver no GitHub

Mantenedores costumam responder em até 1 dia

@ThomasK33 já está trabalhando nisso.

Desde 14/10/2026.

Avaliação

Esta issue ainda não foi avaliada.

Descrição

Problem

Several controllers record a Coder resource ID in the status subresource and then treat that resource as their own. Examples: CoderMCPServer status.configID, CoderAIProvider status.providerID and status.keyID, CoderTemplateTest status.templateID and status.workspaceID, and the IDs in the CoderAIGatewayKey status.

A subject with write access to the status subresource can set such an ID to another Coder resource. The controller then updates that resource to the subject's spec and deletes it with the subject's object. For CoderMCPServer this is threat T19 in the #155 plan: any config in an organization that the control plane lists.

Today only an RBAC contract protects these fields. The docs Roles never grant the status subresource, and the docs warn that resources: ["*"] also grants subresources. The #155 activation (M9) adds an opt-in admission policy that denies codermcpservers/status writes from every subject except the operator ServiceAccount (#155 decision D11, option A).

Proposal (D11 option B)

Record ownership in a form that a status writer cannot forge, for every controller kind at once. One option: an HMAC of the object UID and the Coder resource ID with an operator-held key, checked before the controller acts on a recorded ID.

Open questions:

  1. Where the key lives, and how it rotates.
  2. The recovery path when the key is lost or rotated: re-adopt by the ownership markers that the controllers already write (for example the CoderMCPServer nonce), or require a spec edit.
  3. Migration of objects that already hold an unsigned ID.

Why a follow-up

Option B adds key storage, rotation and a recovery path, and it belongs in all controllers at once, the #154 kinds included. The #155 plan chose option A for v1 and this issue as the follow-up.

Refs #155
Refs #154

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $211.58

Linguagem predominante
Go
Estrelas
5
Forks
3
Merge médio
2h 49min
PRs com merge (30d)
206

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de coder/coder-k8s

Todas as issues de coder/coder-k8s

Issues semelhantes

Mais issues de Go

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.