chore: narrow the RBAC permissions used by the autoscaler #2039
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
RonFed
reviewed
Dec 20, 2024
| @@ -2,12 +2,22 @@ apiVersion: rbac.authorization.k8s.io/v1 | |||
| kind: Role | |||
| metadata: | |||
| name: odigos-autoscaler | |||
| namespace: {{ .Release.Namespace }} | |||
There was a problem hiding this comment.
Why is this removed?
All the permissions here are only for our ns, right?
There was a problem hiding this comment.
helm will automatically apply the resource in the configured namespace, but added it back so it's aligned with other resource in the helm template
| @@ -22,7 +32,6 @@ rules: | |||
| - apps | |||
| resources: | |||
| - daemonsets | |||
| - deployments | |||
There was a problem hiding this comment.
Do we need different permissions for deployments and daemonseta, or is it a separation just for readability?
There was a problem hiding this comment.
It's align with how to CLI sets up these permissions, I just fixed in CLI and copied the content from kubectl get role -o yaml
We can merge them in both CLI and helm, but prefer not to do it as part of the current effort
RonFed
approved these changes
Dec 20, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This reduces the permissions we request to just those we actually use.
Most resources are moved from cluster role to role. only resource we need in cluster level is
instrumentationconfigsto update the datacollection configmaps with file patterns to scrape for logs.Updated the selectors in controller runtime cache.
Tested several flows with CLI and helm.