Slack integration permissions are scoped too broadly.

[windowsrefund]

The Slack integration should not be asking for this permission: Send messages to channels @testkube-bot isn't a member of

[vsukhin]

thank you @windowsrefund good point!

[vsukhin]

for @nicufk to check

[vsukhin]

hey @nicufk I reviewed Testkube bot permissions. First three look ok, why do we need fourth one?

Testkube is requesting permission to access the Testkube Slack workspace

What will Testkube be able to view? Content and info about channels & conversations View basic information about private channels that Testkube has been added to View basic information about public channels in your workspace

What will Testkube be able to do? Perform actions in channels & conversations Send messages as @testkubebot Send messages to channels that @testkubebot isn’t a member of this is what concerned you @windowsrefund ?

[windowsrefund]

yes

[nicufk]

Hey @windowsrefund, from what I remember it was added to fix a bug when the slack bot was not able to send/update messages in public channels despite it being the member of it. If this is a major concern for you, we can raise it and to plan some research on this topic.

[vsukhin]

closing for nowwwww

[windowsrefund]

Why was this closed?

[vsukhin]

https://github.com/kubeshop/testkube/issues/5077#issuecomment-2007355931

[windowsrefund]

Yes I read that but the it doesn't resolve the underlying security concern.

[vsukhin]

hey @windowsrefund Regarding using your own bot with restricted permissions. Can you please try to create it, get Slack token and supply it in helm chart value? https://github.com/kubeshop/helm-charts/blob/develop/charts/testkube/values.yaml#L708

[windowsrefund]

@vsukhin Has something changed to where I might get a different result from when this issue was raised?

[vsukhin]

hey @windowsrefund we didn't change anything, but Testkube Bot is not hardcoded in api, we pass the slack token as a helm chart value. So you can create your own bot with allowed permission set like there https://api.slack.com/start/quickstart and then just pass token value to helm chat. In this case Testkube Bot will not be involved

[windowsrefund]

Based on the feedback here and my understanding our team has decided to use a different approach for notifications, I'll get this closed for the time being. As always, thanks for the feedback.