mirror of
https://github.com/hanzo-ml/spark-operator.git
synced 2026-10-30 20:39:07 +00:00
Rishabh SinghandGitHub
132f481f4b
* fix(kustomize,helm): Align Helm and Kustomize RBAC, args, and sideEffects via code tracing Remove over-provisioned webhook ClusterRole permissions (events, resourcequotas, finalizers/status, extra verbs) that have zero code usage in the webhook binary. Add missing pods and scheduledsparkapplications to Helm policyRules that the controller-runtime cache requires. Add events permission to Kustomize controller leader-election Role (controller has 19 recorder.Eventf calls). Add explicit --kube-api-qps, --kube-api-burst, --feature-gates, and --timestamp-precision flags to Kustomize deployments matching Helm defaults. Fix Helm webhook sideEffects from NoneOnDryRun to None matching all 7 kubebuilder markers (follow-up PR#2915) Signed-off-by: roburishabh <[email protected]> * added resourcequotas: list to both Helm policyRules AND Kustomize ClusterRole Signed-off-by: roburishabh <[email protected]> --------- Signed-off-by: roburishabh <[email protected]>
51 lines
1.0 KiB
YAML
51 lines
1.0 KiB
YAML
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRole
|
|
metadata:
|
|
name: spark-operator-webhook
|
|
labels:
|
|
app.kubernetes.io/name: spark-operator
|
|
app.kubernetes.io/instance: spark-operator
|
|
app.kubernetes.io/component: webhook
|
|
rules:
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- resourcequotas
|
|
verbs:
|
|
- list
|
|
- apiGroups:
|
|
- ""
|
|
resources:
|
|
- pods
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- admissionregistration.k8s.io
|
|
resources:
|
|
- mutatingwebhookconfigurations
|
|
- validatingwebhookconfigurations
|
|
verbs:
|
|
- list
|
|
- watch
|
|
- apiGroups:
|
|
- admissionregistration.k8s.io
|
|
resources:
|
|
- mutatingwebhookconfigurations
|
|
- validatingwebhookconfigurations
|
|
resourceNames:
|
|
- mutating-webhook-configuration
|
|
- validating-webhook-configuration
|
|
verbs:
|
|
- get
|
|
- update
|
|
- apiGroups:
|
|
- sparkoperator.k8s.io
|
|
resources:
|
|
- sparkapplications
|
|
- scheduledsparkapplications
|
|
verbs:
|
|
- get
|
|
- list
|
|
- watch
|