[FLINK-35937] RBAC cleanup #857
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -50,8 +50,6 @@ rules: | ||
| - apps | ||
| resources: | ||
| - deployments | ||
| - replicasets | ||
| verbs: | ||
| - get | ||
| @@ -61,26 +59,20 @@ rules: | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
| - apiGroups: | ||
| - apps | ||
| resources: | ||
| - deployments/scale | ||
| verbs: | ||
| - get | ||
| - update | ||
| - patch | ||
| - apiGroups: | ||
| - flink.apache.org | ||
| resources: | ||
| - flinkdeployments | ||
|
There was a problem hiding this comment. Won't removing finalizers here affect the fix provided in #600? The finalizers were added here specifically for OpenShift, I think it's related to the There was a problem hiding this comment. I'm not the best to judge this. But at least from my point of view the "/finializers" resources are also making trouble with the deployment because it looks like the resources do not exist and (like mentioned above) Kyverno is blocking our deployment because it cannot add verbs to non existing resources. That's at least how I understand it. |
||
| - flinksessionjobs | ||
| verbs: | ||
| - get | ||
| - list | ||
| @@ -89,6 +81,7 @@ rules: | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
|
There was a problem hiding this comment. Why are we adding the delete collection verb to many places? Is this used somewhere? There was a problem hiding this comment. I just added them for "completeness". Because in the past the verbs just were a star ("*"), and |
||
| - apiGroups: | ||
| - flink.apache.org | ||
| resources: | ||
| @@ -110,6 +103,7 @@ rules: | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
| - apiGroups: | ||
| - coordination.k8s.io | ||
| resources: | ||
| @@ -122,6 +116,7 @@ rules: | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
| {{- end }} | ||
|
|
||
| {{/* | ||
| @@ -142,11 +137,11 @@ rules: | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
| - apiGroups: | ||
| - apps | ||
| resources: | ||
| - deployments | ||
| verbs: | ||
| - get | ||
| - list | ||
| @@ -155,6 +150,7 @@ rules: | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
| {{- end }} | ||
|
|
||
| --- | ||
| @@ -245,7 +241,14 @@ rules: | ||
| resources: | ||
| - leases | ||
| verbs: | ||
| - get | ||
| - list | ||
| - watch | ||
| - create | ||
| - update | ||
| - patch | ||
| - delete | ||
| - deletecollection | ||
| {{- end }} | ||
| --- | ||
| {{- if and .Values.rbac.operatorRole.create (not (has .Release.Namespace .Values.watchNamespaces)) }} | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we wish to drop support for extensions/v1beta1 API version of Ingress, I think we can also remove the code in
IngressUtils.java:266. This will make the operator unable to create new Ingress resources for Kubernetes 1.19, but that version has been deprecated for a long time.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I would appreciate getting rid of the extensions part because this is making some trouble with our deployment on a recent managed Kubernetes cluster (1.29) in combination with Kyverno policy management. Kyverno is preventing the deployment because the extensions API does not seem to exist anymore.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@timsn If this is something you specifically don't need you could simply modify your downstream helm chart. But as long as we have users who need this we cannot simply remove it from the base helm template. We would need a discussion on the ML before that
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@gyfora thanks for your response. That's something I cannot judge because I know not enough about what the extensions are used for and if they are still in use. I just discovered that they lead to problems with our deployment process (Kyverno policy checks).
If this would brake something I would be totally fine to remove the change from this PR and do the change downstream on my own.