From b7ea310e4157aae5cc8d44cb2358236b7a307a3f Mon Sep 17 00:00:00 2001 From: Scot Wells Date: Tue, 22 Sep 2026 19:00:38 -0500 Subject: [PATCH] fix(iam): make IPAM read-only for organization members Organization owners inherited ipam.miloapis.com-admin, which carries pool and class CRUD. Every customer is the owner of the organization they create, so every customer could create and delete IP pools and classes in any of their projects. Address space is platform-operated: a pool's CIDR cannot be corrected once an address has been handed out of it. Owner drops the admin grant. Viewer gains ipam.miloapis.com-viewer, which editor and owner both inherit, so members can see the pools and allocations backing their networks where before only owners could. Allocation is unaffected: claims are filed by the network operator under its own identity, not the end user's. --- .../assignable-organization-roles/roles/datum-cloud-owner.yaml | 2 -- .../assignable-organization-roles/roles/datum-cloud-viewer.yaml | 2 ++ 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/assignable-organization-roles/roles/datum-cloud-owner.yaml b/config/assignable-organization-roles/roles/datum-cloud-owner.yaml index 6271932..3a6b577 100644 --- a/config/assignable-organization-roles/roles/datum-cloud-owner.yaml +++ b/config/assignable-organization-roles/roles/datum-cloud-owner.yaml @@ -36,8 +36,6 @@ spec: namespace: milo-system - name: billing.miloapis.com-admin namespace: milo-system - - name: ipam.miloapis.com-admin - namespace: milo-system - name: services.miloapis.com-entitlement-admin namespace: milo-system - name: compute.datumapis.com-admin diff --git a/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml b/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml index 06ca58f..d530462 100644 --- a/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml +++ b/config/assignable-organization-roles/roles/datum-cloud-viewer.yaml @@ -22,6 +22,8 @@ spec: namespace: milo-system - name: dns.networking.miloapis.com-dns-viewer namespace: milo-system + - name: ipam.miloapis.com-viewer + namespace: milo-system - name: iam-user-invitations-reader namespace: milo-system - name: activity.miloapis.com-viewer