search

AxaFrance / SlimFaas

SlimFaas : The slimest and simplest Function As A Service
MIT License
175 stars 7 forks source link

Is is possible to have k8s api permission limited to a namespace scope #35

Closed haarisedhi102 closed 8 months ago

haarisedhi102 commented 8 months ago

The service account Cluster role slimfaas-full-access has broad permissions at a cluster level. Is it possible for slimfass to run properly while relying only utilizing Role at a namespace level.

guillaume-chervet commented 8 months ago

Hi @haarisedhi102 , I am not a kubernetes expert. The demo give full access because i struggule to set it up. I can update the demo with the minimum role required. But in intern at AXA France we use minimum required rôles.

guillaume-chervet commented 8 months ago

In fact slimfaas just use list and scaleDeployment, list and scale statefulset. For the moment, i will plug watch api soon.

haarisedhi102 commented 8 months ago

And list and scale statefulset is recently added right? So for the most basic functionality, only list and scaleDeployment would be required? serviceAccountName: slimfaas Is changing this line in the deployment yaml the only thing required to use a different/existing service account?

haarisedhi102 commented 8 months ago

Updating the demo with minimum api requirements will be very helpful, Thank you

guillaume-chervet commented 8 months ago

I will try to dobit today @haarisedhi102 , after i will be in one week holiday.

guillaume-chervet commented 8 months ago

hi @haarisedhi102 ,

I have update the demo with : https://github.com/AxaFrance/SlimFaas/blob/main/demo/slimfaas-serviceaccount.yml is it what you needed?