From de438eae2e35ce25768f2a7025b22cbb5c2639dc Mon Sep 17 00:00:00 2001
From: Todd Treece <360020+toddtreece@users.noreply.github.com>
Date: Wed, 8 May 2024 12:30:08 -0400
Subject: [PATCH] K8s: Prevent the use of arbitrary namespaces (#83636)

---
 pkg/services/apiserver/auth/authorizer/org_id.go   | 8 ++++++--
 pkg/services/apiserver/auth/authorizer/stack_id.go | 4 ++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkg/services/apiserver/auth/authorizer/org_id.go b/pkg/services/apiserver/auth/authorizer/org_id.go
index e9d4a6786a8..f73d3b59b32 100644
--- a/pkg/services/apiserver/auth/authorizer/org_id.go
+++ b/pkg/services/apiserver/auth/authorizer/org_id.go
@@ -37,11 +37,15 @@ func (auth orgIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attribut
 		return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil
 	}
 
-	// No opinion when the namespace is arbitrary
-	if info.OrgID == -1 {
+	// No opinion when the namespace is empty
+	if info.Value == "" {
 		return authorizer.DecisionNoOpinion, "", nil
 	}
 
+	if info.OrgID == -1 {
+		return authorizer.DecisionDeny, "org id is required", nil
+	}
+
 	if info.StackID != "" {
 		return authorizer.DecisionDeny, "using a stack namespace requires deployment with a fixed stack id", nil
 	}
diff --git a/pkg/services/apiserver/auth/authorizer/stack_id.go b/pkg/services/apiserver/auth/authorizer/stack_id.go
index 0098c1dfd21..da63c25d5ba 100644
--- a/pkg/services/apiserver/auth/authorizer/stack_id.go
+++ b/pkg/services/apiserver/auth/authorizer/stack_id.go
@@ -37,8 +37,8 @@ func (auth stackIDAuthorizer) Authorize(ctx context.Context, a authorizer.Attrib
 		return authorizer.DecisionDeny, fmt.Sprintf("error reading namespace: %v", err), nil
 	}
 
-	// No opinion when the namespace is arbitrary
-	if info.OrgID == -1 {
+	// No opinion when the namespace is empty
+	if info.Value == "" {
 		return authorizer.DecisionNoOpinion, "", nil
 	}