RBAC fix to enable slack cluster queue lending limit adjustment #613
Conversation
The codeflare operator needs permission to read and write clusterqueues to enable the AppWrapper controller to adjust the lending limit of a designated slack cluster queue to reflect cordoned nodes.
|
Although we can work around this in MLBatch, it would be nice if this fix could be merged in time to make the next release so MLBatch only needs to have the patch for the codeflare operator's role in our configuration for RHOAI 2.12. |
There was a problem hiding this comment.
@dgrove-oss The changes seem good to provide right permissions to the slack CQ.
I assume this is only for the purposes of managing the Slack queue (as mentioned in the description). However, do we have admission policy (or a validating webhook) in place to not allow modifications to the slack CQ by anyone other than the app wrapper controller (would need a SA for this). Just concerned that we are not letting the same CQ be modified by Kueue as well as appwrapper controllers.
|
Summarizing an offline discussion, the |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: varshaprasad96 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-merge-bot
bot
merged commit 8fa9455
into
project-codeflare:main
The codeflare operator needs permission to read and write clusterqueues to enable the AppWrapper controller to adjust the lending limit of a designated slack cluster queue to reflect cordoned nodes.