Aleksei Sviridkin f736950fcd feat(cozystack-controller): grant the GPU controller its writes ...

The binder writes finalizers and status on GPU classes, devices and
nodes, deletes template devices with their VMI, and deletes the
unscheduled VMI of a device that must leave its node. The create right
on GPU devices is for the template devices made on behalf of a VMI.

The settings ConfigMap is the only ConfigMap the controller writes, so
its rights live in a Role in cozy-system rather than the ClusterRole:
get, update and patch are scoped to that object by name, and create,
which RBAC cannot scope by name, is scoped by the namespace.

With --metrics-secure the metrics endpoint authenticates and authorizes
each scrape through TokenReview and SubjectAccessReview, so the
controller needs create on both for the GPU metrics to be scraped.

Signed-off-by: Aleksei Sviridkin <f@lex.la>
Assisted-by: LLM

2026-10-21 06:33:44 +03:00

..

leader_election_test.yaml

feat(api): add configurable resources and replicas for cozystack-engine components

2026-09-28 15:19:45 +03:00

rbac_test.yaml

feat(cozystack-controller): grant the GPU controller its writes

2026-10-21 06:33:44 +03:00

resources_test.yaml

feat(api): add configurable resources and replicas for cozystack-engine components

2026-09-28 15:19:45 +03:00

workloadmonitor_crd_test.yaml

feat(api): refuse a WorkloadMonitor with an empty selector

2026-10-02 14:02:37 +03:00