New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Features] Implement ComponentDefinition's PolicyRules #8310

Open

cjc7373 opened this issue Oct 22, 2024 · 1 comment · May be fixed by #8328

Assignees

Labels

area/user-interaction kind/feature

Milestone

Contributor

cjc7373 commented Oct 22, 2024

Some engine may need to interact with k8s, thus needs rbac. ComponentDefinition has a PolicyRules field but is unimplemented. Currently pods will get a role defined in https://github.com/apecloud/kubeblocks/blob/cdd2d013b424dba4645b131bb441630f2e1e1222/deploy/helm/templates/rbac/cluster_pod_required_role.yaml.

We need to remove this file and implement PolicyRules in cmpd.

The text was updated successfully, but these errors were encountered:

cjc7373 added kind/feature area/user-interaction documentation labels

cjc7373 self-assigned this

cjc7373 removed the documentation label

cjc7373 added this to the Release 1.0.0 milestone

Contributor Author

cjc7373 commented Oct 22, 2024 •

edited

Loading

Some notes:

If user has specified a ServiceAccountName in component's spec, then kb will not generate serviceaccount/role/rolebinding.
kb-agent does not need most of kubeblocks-lorry-pod-role, but still needs one rule to create event.

cjc7373 linked a pull request

that will close this issue

feat: implement cmpd's PolicyRules #8328

Draft

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment