You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@heron.apache.org by GitBox <gi...@apache.org> on 2020/09/14 20:52:49 UTC
[GitHub] [incubator-heron] the-scott-hand opened a new pull request #3618: Stop using "cluster admin" role and restrict to ns
the-scott-hand opened a new pull request #3618:
URL: https://github.com/apache/incubator-heron/pull/3618
Heron doesnt need "cluster admin" level permissions, and based on helm chart set up also does not need to manage resources across kubernetes namespaces. Therefore we should be using a Role and RoleBinding combo to only allow heron apiserver to perform actions on statefulsets in its own namespace.
see https://github.com/apache/incubator-heron/issues/3615#issue-701399133
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-heron] nicknezis merged pull request #3618: Stop using "cluster admin" role and restrict to ns
Posted by GitBox <gi...@apache.org>.
nicknezis merged pull request #3618:
URL: https://github.com/apache/incubator-heron/pull/3618
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-heron] nicknezis merged pull request #3618: Stop using "cluster admin" role and restrict to ns
Posted by GitBox <gi...@apache.org>.
nicknezis merged pull request #3618:
URL: https://github.com/apache/incubator-heron/pull/3618
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [incubator-heron] nicknezis commented on pull request #3618: Stop using "cluster admin" role and restrict to ns
Posted by GitBox <gi...@apache.org>.
nicknezis commented on pull request #3618:
URL: https://github.com/apache/incubator-heron/pull/3618#issuecomment-692332286
The Kubernetes scheduler also creates and deletes namespaced services using the `coreClient` as seen [here](https://github.com/apache/incubator-heron/blob/c6f634b75281df424bb402305ea3523db35a616d/heron/schedulers/src/java/org/apache/heron/scheduler/kubernetes/V1Controller.java#L108).
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org