From 1c4923412c27628ce5f15c7914f6825340873e84 Mon Sep 17 00:00:00 2001 From: DrummyFloyd Date: Fri, 24 Jul 2026 17:09:08 +0200 Subject: [PATCH] docs(concepts): clarify override env is literal-only, secrets via template MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Document the template/override trust boundary: workspace override env carries literal values only; valueFrom (secretKeyRef/configMapKeyRef/…) is rejected. Injecting a Secret into a desktop is a template concern (env valueFrom or credentialsSecretRef), resolved server-side. --- docs/concepts/templates-and-protocols.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/concepts/templates-and-protocols.md b/docs/concepts/templates-and-protocols.md index 6728955..9cb5064 100644 --- a/docs/concepts/templates-and-protocols.md +++ b/docs/concepts/templates-and-protocols.md @@ -94,7 +94,9 @@ order: it server-side when a session starts — the browser never sees the values. Ship it with External Secrets/Vault; typically the same Secret also feeds the pod via env `valueFrom` (e.g. - `WAAS_DESKTOP_PASSWORD`) so both sides agree. + `WAAS_DESKTOP_PASSWORD`) so both sides agree. Env `valueFrom` is a + **template-side** channel — workspace overrides only ever carry + literal values (see [Creator overrides](#creator-overrides)). 2. **Generated per-workspace credentials** — the default when nothing explicit is provided: the operator generates a random credential per workspace, stores it in a Secret next to the CR, wires it into the @@ -158,6 +160,21 @@ the effective allow-list is the **intersection** of both. Enforcement is server-side (admission webhook + a reconciler re-check), and every applied override is audited (field and env var _names_, never values). +:::note Overrides carry literal values, not Secret references +An override `env` entry may set only a **literal `value`**. `valueFrom` +sources — `secretKeyRef`, `configMapKeyRef`, `fieldRef`, +`resourceFieldRef` — are **rejected** in a workspace override (by the +same admission webhook that enforces the allow-list, and stripped again +by the operator when the workload is rendered). Wiring a Secret into a +desktop is a **template** decision: the admin who authors the template +references it through env `valueFrom` or +[`credentialsSecretRef`](#credentials), both resolved against the +workspace's own namespace. The template — authored by an admin, +typically through GitOps — is therefore the only channel that can point +a desktop at a cluster Secret; a workspace creator tunes values, never +references Secrets. +::: + :::warning Allow-listing `volumes` lets users mount arbitrary volume sources — including `hostPath`. Only enable it on templates aimed at trusted