Skip to content

Limit privileges of DevWorkspace serviceaccount #342

@amisevsk

Description

@amisevsk

Description

I came across a half-written TODO today (I wrote it -- it's my bad):

// TODO: The rolebindings here are created namespace-wide; find a way to limit this, given that each workspace

The idea here was to restrict the devworkspace SA to only have control over workspace-related objects (and avoid a potential -- but slight -- privilege escalation).

Should we still proceed with trying to do this? Currently, being able to start workspaces gives the user the privileges to CRUD devworkspaces and devworkspacetemplates, create permissions on pods/exec, and view permissions on all pods/deployments/replicasets/devworkspaceroutings in the devworkspace's namespace.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions