rbac: add resourceclaims/binding for DRA granular status authorization#259
Conversation
|
Welcome @cairon-ab! It looks like this is your first PR to volcano-sh/agentcube 🎉 |
There was a problem hiding this comment.
Pull request overview
This PR adds RBAC permissions required for Kubernetes v1.36's DRAResourceClaimGranularStatusAuthorization feature, which enforces fine-grained authorization checks for ResourceClaim status updates by the Volcano agent scheduler.
Changes:
- Adds RBAC rule granting the Volcano agent scheduler
updateandpatchpermissions on theresourceclaims/bindingsynthetic subresource in theresource.k8s.ioAPI group - This permission is required in addition to the existing
resourceclaims/statuspermission when the feature gate is enabled - The change is backward compatible and inert on Kubernetes versions prior to v1.36
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #259 +/- ##
==========================================
+ Coverage 35.60% 43.35% +7.74%
==========================================
Files 29 30 +1
Lines 2533 2611 +78
==========================================
+ Hits 902 1132 +230
+ Misses 1505 1358 -147
+ Partials 126 121 -5
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Starting in Kubernetes v1.36, the DRAResourceClaimGranularStatusAuthorization feature gate (beta, on-by-default) enforces fine-grained authorization checks for ResourceClaim status updates. Schedulers that modify status.allocation or status.reservedFor now require additional permissions on the resourceclaims/binding synthetic subresource. This adds the required RBAC rule for the agent scheduler. These permissions are inert on Kubernetes versions prior to v1.36. Ref: kubernetes/kubernetes#138149 Signed-off-by: Cairon <[email protected]>
cairon-ab
force-pushed
the
add-dra-granular-status-auth-rbac
branch
from
68d0a3e to
c31a984
Compare
hzxuzhonghu
left a comment
hzxuzhonghu
left a comment
There was a problem hiding this comment.
@JesseStutler Does agent scheduler support DRA currently?
I think yes @hzxuzhonghu, we have already imported the DRA into predicates plugin, and the agent scheduler contains predicates plugin |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hzxuzhonghu The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Starting in Kubernetes v1.36, the
DRAResourceClaimGranularStatusAuthorizationfeature gate (beta, on-by-default) enforces fine-grained authorization checks forResourceClaimstatus updates.Schedulers that modify
status.allocationorstatus.reservedFornow require additional permissions on theresourceclaims/bindingsynthetic subresource withupdateandpatchverbs.This adds the required RBAC rule for the Volcano agent scheduler. The existing
resourceclaims/statuspermission is still required and remains unchanged.These new permissions are inert on Kubernetes versions prior to v1.36, so this is safe to merge now in preparation.
Ref: kubernetes/kubernetes#138149