Aleksei Sviridkin eb3508a7dd feat(cozystack-controller): grant the GPU controller its writes ...

The binder writes finalizers and status on GPU classes, claims and
nodes, creates and deletes the template claims of a VMI's
claimTemplate entries, updates a gated launcher pod to pin and release
it, deletes a pinned launcher pod its node refuses, and deletes the
unscheduled VMI of a claim that must leave its node once that VMI's
pod is pinned. RBAC cannot narrow the pod rights to launcher pods. It
reports on a VMI, through events.k8s.io, why its pod stays gated.

The settings ConfigMap is the only ConfigMap the controller writes, so
its rights live in a Role in cozy-system rather than the ClusterRole:
get, update and patch are scoped to that object by name, and create,
which RBAC cannot scope by name, is scoped by the namespace.

With --metrics-secure the metrics endpoint authenticates and authorizes
each scrape through TokenReview and SubjectAccessReview, so the
controller needs create on both for the GPU metrics to be scraped.

Assisted-by: LLM
Signed-off-by: Aleksei Sviridkin <f@lex.la>

2026-10-26 11:22:37 +03:00

..

leader_election_test.yaml

feat(api): add configurable resources and replicas for cozystack-engine components

2026-09-28 15:19:45 +03:00

rbac_test.yaml

feat(cozystack-controller): grant the GPU controller its writes

2026-10-26 11:22:37 +03:00

resources_test.yaml

feat(api): add configurable resources and replicas for cozystack-engine components

2026-09-28 15:19:45 +03:00

workloadmonitor_crd_test.yaml

feat(api): refuse a WorkloadMonitor with an empty selector

2026-10-02 14:02:37 +03:00