mirror of
https://github.com/hanzo-ml/spark-operator.git
synced 2026-10-30 20:39:07 +00:00
Rishabh SinghandGitHub
132f481f4b
* fix(kustomize,helm): Align Helm and Kustomize RBAC, args, and sideEffects via code tracing Remove over-provisioned webhook ClusterRole permissions (events, resourcequotas, finalizers/status, extra verbs) that have zero code usage in the webhook binary. Add missing pods and scheduledsparkapplications to Helm policyRules that the controller-runtime cache requires. Add events permission to Kustomize controller leader-election Role (controller has 19 recorder.Eventf calls). Add explicit --kube-api-qps, --kube-api-burst, --feature-gates, and --timestamp-precision flags to Kustomize deployments matching Helm defaults. Fix Helm webhook sideEffects from NoneOnDryRun to None matching all 7 kubebuilder markers (follow-up PR#2915) Signed-off-by: roburishabh <[email protected]> * added resourcequotas: list to both Helm policyRules AND Kustomize ClusterRole Signed-off-by: roburishabh <[email protected]> --------- Signed-off-by: roburishabh <[email protected]>
161 lines
4.9 KiB
YAML
161 lines
4.9 KiB
YAML
{{/*
|
|
Copyright 2024 The Kubeflow authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
https://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/}}
|
|
|
|
{{- if .Values.webhook.enable }}
|
|
apiVersion: admissionregistration.k8s.io/v1
|
|
kind: MutatingWebhookConfiguration
|
|
metadata:
|
|
name: {{ include "spark-operator.webhook.name" . }}
|
|
labels:
|
|
{{- include "spark-operator.webhook.labels" . | nindent 4 }}
|
|
{{- if .Values.certManager.enable }}
|
|
annotations:
|
|
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "spark-operator.certManager.certificate.name" . }}
|
|
{{- end }}
|
|
webhooks:
|
|
- name: mutate--v1-pod.sparkoperator.k8s.io
|
|
admissionReviewVersions: ["v1"]
|
|
clientConfig:
|
|
service:
|
|
name: {{ include "spark-operator.webhook.serviceName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
port: {{ .Values.webhook.port }}
|
|
path: /mutate--v1-pod
|
|
sideEffects: None
|
|
{{- with .Values.webhook.failurePolicy }}
|
|
failurePolicy: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.spark.jobNamespaces }}
|
|
{{- if not (has "" .) }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: In
|
|
values:
|
|
{{- range $jobNamespace := . }}
|
|
- {{ $jobNamespace }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
objectSelector:
|
|
matchLabels:
|
|
sparkoperator.k8s.io/launched-by-spark-operator: "true"
|
|
rules:
|
|
- apiGroups: [""]
|
|
apiVersions: ["v1"]
|
|
resources: ["pods"]
|
|
operations: ["CREATE"]
|
|
{{- with .Values.webhook.timeoutSeconds }}
|
|
timeoutSeconds: {{ . }}
|
|
{{- end }}
|
|
- name: mutate-sparkoperator-k8s-io-v1beta2-sparkapplication.sparkoperator.k8s.io
|
|
admissionReviewVersions: ["v1"]
|
|
clientConfig:
|
|
service:
|
|
name: {{ include "spark-operator.webhook.serviceName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
port: {{ .Values.webhook.port }}
|
|
path: /mutate-sparkoperator-k8s-io-v1beta2-sparkapplication
|
|
sideEffects: None
|
|
{{- with .Values.webhook.failurePolicy }}
|
|
failurePolicy: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.spark.jobNamespaces }}
|
|
{{- if not (has "" .) }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: In
|
|
values:
|
|
{{- range $jobNamespace := . }}
|
|
- {{ $jobNamespace }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
rules:
|
|
- apiGroups: ["sparkoperator.k8s.io"]
|
|
apiVersions: ["v1beta2"]
|
|
resources: ["sparkapplications"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
{{- with .Values.webhook.timeoutSeconds }}
|
|
timeoutSeconds: {{ . }}
|
|
{{- end }}
|
|
- name: mutate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication.sparkoperator.k8s.io
|
|
admissionReviewVersions: ["v1"]
|
|
clientConfig:
|
|
service:
|
|
name: {{ include "spark-operator.webhook.serviceName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
port: {{ .Values.webhook.port }}
|
|
path: /mutate-sparkoperator-k8s-io-v1beta2-scheduledsparkapplication
|
|
sideEffects: None
|
|
{{- with .Values.webhook.failurePolicy }}
|
|
failurePolicy: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.spark.jobNamespaces }}
|
|
{{- if not (has "" .) }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: In
|
|
values:
|
|
{{- range $jobNamespace := . }}
|
|
- {{ $jobNamespace }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
rules:
|
|
- apiGroups: ["sparkoperator.k8s.io"]
|
|
apiVersions: ["v1beta2"]
|
|
resources: ["scheduledsparkapplications"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
{{- with .Values.webhook.timeoutSeconds }}
|
|
timeoutSeconds: {{ . }}
|
|
{{- end }}
|
|
- name: mutate-sparkoperator-k8s-io-v1alpha1-sparkconnect.sparkoperator.k8s.io
|
|
admissionReviewVersions: ["v1"]
|
|
clientConfig:
|
|
service:
|
|
name: {{ include "spark-operator.webhook.serviceName" . }}
|
|
namespace: {{ .Release.Namespace }}
|
|
port: {{ .Values.webhook.port }}
|
|
path: /mutate-sparkoperator-k8s-io-v1alpha1-sparkconnect
|
|
sideEffects: None
|
|
{{- with .Values.webhook.failurePolicy }}
|
|
failurePolicy: {{ . }}
|
|
{{- end }}
|
|
{{- with .Values.spark.jobNamespaces }}
|
|
{{- if not (has "" .) }}
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: In
|
|
values:
|
|
{{- range $jobNamespace := . }}
|
|
- {{ $jobNamespace }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- end }}
|
|
rules:
|
|
- apiGroups: ["sparkoperator.k8s.io"]
|
|
apiVersions: ["v1alpha1"]
|
|
resources: ["sparkconnects"]
|
|
operations: ["CREATE", "UPDATE"]
|
|
{{- with .Values.webhook.timeoutSeconds }}
|
|
timeoutSeconds: {{ . }}
|
|
{{- end }}
|
|
{{- end }}
|