Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove unnecessary RBAC rule for mpijobs-admin*** #630

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Remove unnecessary RBAC rule for mpijobs-admin*** #630

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion deploy/v2beta1/mpi-operator.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8473,7 +8473,6 @@ metadata:
app.kubernetes.io/name: mpi-operator
kustomize.component: mpi-operator
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-mpijobs-admin: "true"
name: kubeflow-mpijobs-edit
rules:
- apiGroups:
Expand Down
1 change: 0 additions & 1 deletion manifests/base/cluster-role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,6 @@ metadata:
name: kubeflow-mpijobs-edit
labels:
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-edit: "true"
rbac.authorization.kubeflow.org/aggregate-to-kubeflow-mpijobs-admin: "true"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why remove this? An admin might need to perform edits in case of emergencies.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If that's the case, then we should define rules for admin. Right now, rules for admin are empty array and when the admin annotation is added to edit clusterrole, it keeps overriding admin role. If we expect the admin to have slightly different role than edit then it would make sense to keep both otherwise I would suggest removing the admin role

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@terrytangyuan @rongou which practices are you following in the training-operator?
I don't have all the context to make a decision here.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@alculquicondor IIRC, The training-operator doesn't use RBAC aggregations: https://github.com/kubeflow/training-operator/blob/2eff94ea8131879c7175ba6ae9e3d7d098f92f85/manifests/base/rbac/role.yaml

I guess that this setting seems to be only for the MPIJob v2.

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

but these rules were added before we created the v2. So I'm not really sure what's the context.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It makes sense. Actually, I also don't have any context...

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any relation to admin rule anywhere in the code. I think it is safe to delete all together but I'd leave that decision to you.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we merge this PR? If not then I will close it

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe @johnugeorge has some context of the original intent?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't have context either. I wonder if it's for integration with UI or some other front-ends.

rules:
- apiGroups:
- kubeflow.org
Expand Down