mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-24 20:16:50 +09:00
Aleksei Sviridkin
d060ebdefe
The binder writes finalizers and status on GPU classes, devices and nodes, deletes template devices with their VMI, and deletes the unscheduled VMI of a device that must leave its node; the admission webhook in the same binary creates template devices. The settings ConfigMap is the only ConfigMap the controller writes, so its rights live in a Role in cozy-system rather than the ClusterRole: get, update and patch are scoped to that object by name, and create, which RBAC cannot scope by name, is scoped by the namespace. With --metrics-secure the metrics endpoint authenticates and authorizes each scrape through TokenReview and SubjectAccessReview, so the controller needs create on both for the GPU metrics to be scraped. Signed-off-by: Aleksei Sviridkin <f@lex.la> Assisted-by: LLM