🤖 CoderWorkspacePool Share mode: an idle-reaped workspace that the pool keeps stays shared without policy checks
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 18/100
- Issue 类型
- 缺陷
- 描述清晰度
- 需要澄清
- 活跃度
- 活跃
- 技术栈
- go, kubernetes
调研方向
The release path is in internal/controller/coderworkspacepoolmember_cleanup.go, at the result.kept branch where the member keeps the workspace and drops its finalizer. The issue asks a maintainer to choose between removing the operator's ACL entry before release and keeping the share with documentation, so settle that first. Done means the chosen option is implemented or documented and a test covers a kept Share workspace after an idle reap.
由索引模型根据 Issue 内容生成。
描述
Problem
With claims.idleTimeoutSeconds (#447), the pool deletes the member of an idle claim. Right before the delete build, the member reads the workspace once more. If that read shows a use after the pool's idle check, or no last_used_at, the member keeps the workspace in Coder and releases its finalizer (internal/controller/coderworkspacepoolmember_cleanup.go, the result.kept path). The claim is then Lost with IdleTimeout.
For a Share claim (#446), the kept workspace still lists the shared user in its ACL with use. After the release, no member checks the share policy for that workspace any more. If an admin later removes the user from the listed groups, empties shareGroupIDs, or suspends the user, nothing removes the share.
Found by the Codex security review of #446 (P2): https://github.com/coder/coder-k8s/pull/446#discussion_r4433862590
Impact
The user keeps the access that the policy granted before the release, on a workspace that the user was using a moment before. No data loss. The window to reach this path is short: a use between the pool's idle check and the member's last read. The same holds for other leftover workspaces, for example after a control plane delete (#448).
Design question
- Remove the operator's ACL entry before the release. Then policy withdrawal can no longer matter, but the shared user loses the way back to the kept work: #447's message tells the claimant that
coder ssh <owner>/<workspace>still reaches a kept workspace, and for a Share claim that works only through the share. Coder also applies the removal only after a restart (#450). - Keep the share, and document that a kept Share workspace stays shared and needs a manual
coder sharing removewhen the admin cleans up leftovers.
Refs #153.
Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: xhigh
- 主要语言
- Go
- 星标
- 5
- 派生
- 3
- 平均合并
- 1 小时 50 分钟
- 30 天内合并 PR
- 160
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
coder/coder-k8s 的其他 Issue
-
难度 3/5 半天 新手友好度 62/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
-
难度 3/5 半天 新手友好度 45/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 30/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 8/100
维护者通常 1 天内回复
相似的 Issue
-
bug
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 72/100
open-feature/flagd-schemas#237 ·
-
enhancement
难度 2/5 1-3 小时 新手友好度 72/100
superplanehq/superplane#9234 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 65/100
betterleaks/betterleaks#469 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
prime-radiant-inc/evener#5901 ·
维护者通常 1 天内回复