-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
support multiple namespaces #1955
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not sure if changing Roles and RoleBindings to ClusterRoles and ClusterRoleBindings respectively is a good idea. RBAC permissions should be as tight as possible for security reasons. It's better to create a role and role binding for each application namespace
4955e24
to
d8b454e
Compare
Changed to Role and RoleBinding loop |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you add more details to how this PR was tested? Specifically, it will be good to verify that webhook still works as expected. Some web hook resources are namespace specific. I don't remember which ones off the top of my head, but the webhook service and MutatingWebhookConfiguration objects are good to validate
06d2428
to
ba9a08d
Compare
Signed-off-by: Andrew Chubatiuk <[email protected]>
ba9a08d
to
f51bd4f
Compare
Signed-off-by: Andrew Chubatiuk <[email protected]>
@yuchaoran2011 I've beed running it in my project for several month in such setup. I see mutatingwebhooks for pods only and it monitors namespaces depending on operator's |
it makes sense to migrate operator to kubebuilder v4, it simplifies setup and management a lot and also reduces amount of code lines |
@yuchaoran2011 do you expect any other changes here? |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: AndrewChubatiuk, yuchaoran2011 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
* support multiple namespaces Signed-off-by: Andrew Chubatiuk <[email protected]> * bump helm chart version Signed-off-by: Andrew Chubatiuk <[email protected]> --------- Signed-off-by: Andrew Chubatiuk <[email protected]> Signed-off-by: Peter McClonski <[email protected]>
* support multiple namespaces Signed-off-by: Andrew Chubatiuk <[email protected]> * bump helm chart version Signed-off-by: Andrew Chubatiuk <[email protected]> --------- Signed-off-by: Andrew Chubatiuk <[email protected]>
* support multiple namespaces Signed-off-by: Andrew Chubatiuk <[email protected]> * bump helm chart version Signed-off-by: Andrew Chubatiuk <[email protected]> --------- Signed-off-by: Andrew Chubatiuk <[email protected]>
replaced sparkJobNamespace with sparkJobNamespaces, added creation of spark role, serviceaccount and rolebinding for every spark job namespace