Request for information about Roles and ClusterRoles about deployments-k8s HOT 7 CLOSED

Could you explain for what do you need roles?

from deployments-k8s.

We are working on a Helm chart for NSM, and have to meet some requirements. One of them is that DaemonSets, Deployments, etc should not use the default roles, but should have their own, together with RoleBinding.

from deployments-k8s.

@rpiceage OK... so lets talk through this to make sure I understand :)

Are you asking the that Role and ClusterRole for the various Pods/Daemonsets/Deployments in the NSM system?

If so, I presume you are seeking to converge on the most restrictive Role/ClusterRole that will work for those Pods/Daemonsets/Deployments correct?

I believe that the only cmd-* we have that are interacting with the k8s API are:

• cmd-forwarder-sriov
• cmd-exclude-prefixes-k8s
• cmd-registry-k8s

from deployments-k8s.

@edwarnicke Yes, you got it right about the most restrictive Role.
Does this mean that cmd-registry-memory, cmd-nsmgr and cmd-forwarder-vpp do not require anything specified it their most restrictive Roles?

from deployments-k8s.

@rpiceage Not in terms of their interactions with the K8s API. cmd-forwarder-vpp does need to run privileged.

from deployments-k8s.

@edwarnicke Thanks for the info.

from deployments-k8s.

@rpiceage Which brings us around to the question... do you need Roles and ClusterRoles for:

• cmd-forwarder-sriov
• cmd-exclude-prefixes-k8s
• cmd-registry-k8s

I believe cmd-forwarder-sriov has dependencies on k8s due to it providing a device plugin

I believe cmd-exclude-prefixes-k8s mostly reads from the K8s API, but also writes ConfigMaps

cmd-registry-k8s maintains CRDs to store NSM registry entries.

from deployments-k8s.