mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-08 21:14:56 +09:00
Aleksei Sviridkin
eb3508a7dd
The binder writes finalizers and status on GPU classes, claims and nodes, creates and deletes the template claims of a VMI's claimTemplate entries, updates a gated launcher pod to pin and release it, deletes a pinned launcher pod its node refuses, and deletes the unscheduled VMI of a claim that must leave its node once that VMI's pod is pinned. RBAC cannot narrow the pod rights to launcher pods. It reports on a VMI, through events.k8s.io, why its pod stays gated. The settings ConfigMap is the only ConfigMap the controller writes, so its rights live in a Role in cozy-system rather than the ClusterRole: get, update and patch are scoped to that object by name, and create, which RBAC cannot scope by name, is scoped by the namespace. With --metrics-secure the metrics endpoint authenticates and authorizes each scrape through TokenReview and SubjectAccessReview, so the controller needs create on both for the GPU metrics to be scraped. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>