security bug: bad auth in ks-devop apiserver.

What is version of KubeSphere DevOps has the issue?

3.2.1

How did you install the Kubernetes? Or what is the Kubernetes distribution?

kk create cluster --with-kubernetes v1.21.5 --with-kubesphere v3.2.1

What happened?

• in "devops-apiserver", there has been "identity authentication",but no "authority division"
• in "devops-apiserver", all api can be access using "anonymous" user
• in "kubesphere cluster", there is no NetworkPolicy.

so, by default, any pod in "kubesphere cluster" can access all api in "devops-apiserver".

root@ip-172-31-14-33:~# curl 10.233.30.131:9090/v1alpha2/devops/go-sec-code4bgns/pipelines/build
{
 "_class": "io.jenkins.blueocean.rest.impl.pipeline.PipelineImpl",
 "_links": {
  "self": {
   "_class": "io.jenkins.blueocean.rest.hal.Link",
   "href": "/blue/rest/organizations/jenkins/pipelines/go-sec-code4bgns/pipelines/build/"
  },
  "scm": {
   "_class": "io.jenkins.blueocean.rest.hal.Link",
   "href": "/blue/rest/organizations/jenkins/pipelines/go-sec-code4bgns/pipelines/build/scm/"
  },
...

what i expect to happen is: by default, person can only do operate(include create、update、delete、read) to their projects and pipeline information.

Relevant log output

No response

Additional information

No response

Start with the devops-apiserver entry points serving /v1alpha2/devops and reproduce the anonymous curl request shown in the issue. Trace how identity authentication and project or pipeline authorization are applied, then verify that users cannot read or modify other projects and pipelines.