CoderWorkspacePool: count bound and used members only when their owner matches the pool's owner
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 半天
- 新手友好度
- 62/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- go, kubernetes
调研方向
Start in countPoolMembers in internal/controller/coderworkspacepool_controller.go (around lines 767-780) and find where the pool's resolved owner ID is computed so you can compare against it. Only increment the bound and used counts when a member's spec.ownerID matches that owner. Done when a foreign-owner bound member no longer changes boundReplicas or usedReplicas, and an envtest covering that case passes.
由索引模型根据 Issue 内容生成。
描述
Problem
The pool counts a bound or used member toward its bound and used counts without checking that the member's spec.ownerID matches the pool's resolved owner. countPoolMembers (internal/controller/coderworkspacepool_controller.go:767-780) increments both counts before it checks any owner ID.
The #153 plan lists this as optional hardening (section 16, item 777(c) of the #357 final assessor items). The #463 round-2 verifier found it unimplemented and untracked.
Impact
Low. Users have read-only RBAC on members (threat T4), so only the operator or a cluster admin can create a member whose owner differs from its pool. Such a member can skew readyReplicas, boundReplicas or usedReplicas and the replacement decisions that use them.
Fix
Count a bound or used member only when its spec.ownerID equals the pool's resolved owner ID. Add an envtest with a foreign-owner bound member.
Refs #153.
Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high
- 主要语言
- Go
- 星标
- 5
- 派生
- 3
- 平均合并
- 2 小时 49 分钟
- 30 天内合并 PR
- 206
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
coder/coder-k8s 的其他 Issue
-
难度 4/5 3-5 天 新手友好度 35/100
维护者通常 1 天内回复
-
难度 3/5 半天 新手友好度 45/100
维护者通常 1 天内回复
-
难度 4/5 3-5 天 新手友好度 30/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 8/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 40/100
维护者通常 1 天内回复
相似的 Issue
-
fix(scan): validate and normalize output format in validate-contract可能已有人在做 @WKr1shna 今天认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
bug good first issue help wanted
难度 2/5 1-3 小时 新手友好度 70/100
-
Won't Fix
难度 2/5 1-3 小时 新手友好度 62/100
microsoft/TypeScript#65107 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 78/100
argoproj/argo-workflows#17397 ·
维护者通常 1 天内回复