search

project-codeflare / multi-cluster-app-dispatcher

Holistic job manager on Kubernetes
Apache License 2.0
108 stars 63 forks source link

Use an aggregated ClusterRole to aggregate roles required for workload resources #635

Open astefanutti opened 1 year ago

astefanutti commented 1 year ago

WHY

MCAD perform CRUD permissions on an unbounded set of resources when processing AppWrappers.

At the moment, users have to create ClusterRoles and bind them to the MCAD ServiceAccount.

Conventionally, operators / controllers leverage aggregated ClusterRoles to meet that need, which prevents the users from having to create ClusterRoleBinding resources.

See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles

WHAT

Create an aggregated ClusterRole, bound to MCAD ServiceAccount.

Document how to aggregate Roles, e.g. for KubeRay resources.