Summary
The handle_create_sandbox_template handler has no per-workspace count limit. A workspace admin can create an unlimited number of templates, potentially exhausting persistence storage and making list calls expensive.
Context
Identified during PR #2781 review. Individual template field sizes are validated (MAX_TEMPLATE_STRING_LEN, MAX_TEMPLATE_STRUCT_SIZE), but there is no aggregate quota per workspace.
This is part of a broader pattern: workspace-scoped resource quotas don't exist yet. The same concern applies to disruption protection (discussed in PR #2692 where a user could continuously create protected sandboxes to block cluster upgrades).
Proposed Change
Add a MAX_TEMPLATES_PER_WORKSPACE constant (e.g., 1000) and check the count before put_if in handle_create_sandbox_template. Return RESOURCE_EXHAUSTED if exceeded, consistent with how MAX_PROVIDERS caps provider attachments.
Consider whether this should be a gateway-level config (like maxDuration for disruption protection) rather than a hardcoded constant, to allow platform admins to tune per deployment.
Related
Summary
The
handle_create_sandbox_templatehandler has no per-workspace count limit. A workspace admin can create an unlimited number of templates, potentially exhausting persistence storage and makinglistcalls expensive.Context
Identified during PR #2781 review. Individual template field sizes are validated (
MAX_TEMPLATE_STRING_LEN,MAX_TEMPLATE_STRUCT_SIZE), but there is no aggregate quota per workspace.This is part of a broader pattern: workspace-scoped resource quotas don't exist yet. The same concern applies to disruption protection (discussed in PR #2692 where a user could continuously create protected sandboxes to block cluster upgrades).
Proposed Change
Add a
MAX_TEMPLATES_PER_WORKSPACEconstant (e.g., 1000) and check the count beforeput_ifinhandle_create_sandbox_template. ReturnRESOURCE_EXHAUSTEDif exceeded, consistent with howMAX_PROVIDERScaps provider attachments.Consider whether this should be a gateway-level config (like
maxDurationfor disruption protection) rather than a hardcoded constant, to allow platform admins to tune per deployment.Related