Repository navigation
[backport v0.10 - rancher v2.14] reject user operations on rancher-managed resource quota and limit range resources - #1797#1797 - #1798
Merged
Conversation
This was referenced Aug 20, 2026
andreas-kupries
requested review from
JonCrowther,
bigkevmcd and
pmatseykanets
September 3, 2026 14:16
bigkevmcd
approved these changes
Sep 3, 2026
….github.com> boilerplate from copilot still present. unit tests and checks completely rewritten added validators for resource quota to webhook added docs, extended webhook codegen the new validator rejects creation, edition, deletion of rancher managed resources. the new validator further rejects promotion of unmanaged to managed resource, and vice versa. the managed resource is recognized by its marker label. the validator is written with the assumption that rancher requests are tagged with webhook bypass and therefore do not reach the validator. unit tests. all of the above for limit range resources as well.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> fix Limitrange typo fix Resourcequota typo
Co-authored-by: andreas-kupries <577247+andreas-kupries@users.noreply.github.com>
andreas-kupries
force-pushed
the
extended-quota-enforcement-2.14
branch
from
September 3, 2026 14:53
9083ae2 to
890b8c3
Compare
rohitsuse
approved these changes
Sep 4, 2026
rohitsuse
left a comment
rohitsuse
left a comment
Member
There was a problem hiding this comment.
LGTM from Frameworks persepective.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue:
rancher/rancher#56774
Companion PR r/rancher rancher/rancher#56804
Problem
The NRQR (Rancher-managed namespace
ResourceQuota, identified by labelresourcequota.management.cattle.io/default-resource-quota: true) was enforced only at namespace creation time. Any user with RBAC access toresourcequotascould subsequently edit the object directly, fully bypassing project-level enforcement.The same is true for the LimitRange resource managed by Rancher.
Solution
Added validating webhooks for
ResourceQuotaandLimitRangeobjects.The companion PR modifies Rancher to send its requests using the webhook bypass.
This means that the new validators see only user initiated requests, and only have to reject operations involving the marker label. IOW