-
Notifications
You must be signed in to change notification settings - Fork 68
Closed
Milestone
Description
Description
I came across a half-written TODO today (I wrote it -- it's my bad):
// TODO: The rolebindings here are created namespace-wide; find a way to limit this, given that each workspace
The idea here was to restrict the devworkspace SA to only have control over workspace-related objects (and avoid a potential -- but slight -- privilege escalation).
Should we still proceed with trying to do this? Currently, being able to start workspaces gives the user the privileges to CRUD devworkspaces
and devworkspacetemplates
, create permissions on pods/exec
, and view permissions on all pods/deployments/replicasets/devworkspaceroutings in the devworkspace's namespace.
Metadata
Metadata
Assignees
Labels
No labels