search

giantswarm / roadmap

Giant Swarm Product Roadmap
https://github.com/orgs/giantswarm/projects/273
Apache License 2.0
3 stars 0 forks source link

rbac-operator needs to give access to cluster scoped capi identity resources #3666

Open anvddriesch opened 2 months ago

anvddriesch commented 2 months ago

related: https://gigantic.slack.com/archives/C02HLSDH3DZ/p1725444409220559

In AWS case, we are using the AWSClusterRoleIdentity CR which is not namespaced. Currently, the automation SA can not access this resource and a ClusterRoleBinding is needed to give access to it (due to it being cluster scoped) which customers can not create. In the meantime we have created it manually. However, it is likely that similar resources exist on other providers or that other customers need access to the same one. We should support this in rbac-operator.

alex-dabija commented 2 months ago

@anvddriesch team BigMac pretty much doesn't exist anymore.

@yulianedyalkova could you check with your team if it fits team tenet? (I'll move it to team tenet for now).

yulianedyalkova commented 2 months ago

The new team (BigMac + Shield) should still be responsible for MCs, right? I think for now it makes sense to move it to where people have more context.

And we need to have a meeting to redistribute components as Tenet also doesn't have capacity to inherit everything that is left without an owner.