Add dedicated ServiceAccount for perftune jobs #1971
Conversation
tnozicka
added
kind/feature
scylla-operator-bot
bot
added
do-not-merge/work-in-progress
scylla-operator-bot
bot
added
the
approved
tnozicka
force-pushed
the
perftune-sa
branch
3 times, most recently
from
81b5246 to
25f1cf9
Compare
tnozicka
changed the title
scylla-operator-bot
bot
removed
the
do-not-merge/work-in-progress
|
@zimnx @rzetelskik ptal |
scylla-operator-bot
bot
added
size/XL
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rzetelskik, tnozicka The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
|
||
| // Delete any excessive Roles. | ||
| // Delete has to be the first action to avoid getting stuck on quota. | ||
| err := controllerhelpers.Prune( |
There was a problem hiding this comment.
shouldn't Prune complain about missing controllerref on deleted objects? We are not allowed to delete them. There should be an option to disable it on justified cases similar to apply functions.
There was a problem hiding this comment.
You already give it a set of claimed and pre-existing objects so it's assumed you own them by how you've claimed them in the fist place. If you were to do a patch or update instead you'd not have rechecked again. For the case of the helper it's cheap but I'd not couple it to this PR.
There was a problem hiding this comment.
I meant to add a safety check so we won't delete objects we weren't meant to delete. Filing an issue for future improvement is fine.
tnozicka
changed the title
scylla-operator-bot
bot
added
the
do-not-merge/work-in-progress
tnozicka
changed the title
scylla-operator-bot
bot
removed
the
do-not-merge/work-in-progress
| }, | ||
| ncc.eventRecorder) | ||
| if err != nil { | ||
| return fmt.Errorf("can't prune RoleBinding(s): %w", err) |
There was a problem hiding this comment.
| return fmt.Errorf("can't prune RoleBinding(s): %w", err) | |
| return fmt.Errorf("can't prune Role(s): %w", err) |
|
|
||
| // Delete any excessive Roles. | ||
| // Delete has to be the first action to avoid getting stuck on quota. | ||
| err := controllerhelpers.Prune( |
There was a problem hiding this comment.
I meant to add a safety check so we won't delete objects we weren't meant to delete. Filing an issue for future improvement is fine.
|
Thanks for updates |
|
#1996 (comment) |
|
#1996 (comment) |
|
#1996 (comment) |
Description of your changes:
This PR adds a dedicated ServiceAccount to use for perftune jobs which enhances security isolation and allows some platforms (like OpenShift) to grant it extra permissions.
Which issue is resolved by this Pull Request:
Resolves #1975
Requires: