[bug bash] Actor logs are controlled by Kubernetes RBAC on the pool namespace, not atespace roles #3242

kubectl ate logs actor looks like it's covered by atespace authorization, but it isn't. Atespace roles don't control access to actor logs. Kubernetes RBAC on the worker pool namespace does.

LogsActorRunner in cmd/kubectl-ate/internal/cmd/actor.go calls GetActor, which is authorized, to find the worker pod. It then reads that pod's log through the Kubernetes API with the caller's kubeconfig. The GetActor call is the only atespace check, and it runs in the client. kubectl logs <worker-pod> skips it.

WorkerPools are shared across atespaces. On main (ffed855), an actor in atespace team-b ran on worker pod counter-f984c8c85-l7dr9 in Kubernetes namespace ate-demo-counter. Anyone with pods/log there can read that actor's output without any role on team-b. Going the other way, a team-b viewer with no Kubernetes access can't read their own actor's logs.

#2043 tracks the missing per-actor log API, which is the real fix. Until that lands, docs/authorization.md should list this under "Known limitations": atespace roles don't cover actor logs, and pods/log in a pool namespace exposes the logs of every atespace that uses the pool. The kubectl ate logs help could say the same.

Found during the authorization bug bash, with help from an AI agent. I checked the code path and the pod placement on the cluster.