kubeflow / kubeflow/mpi-operator
Running in a subset of namespaces
- Dominant language
- Go
- Stars
- 535
- Forks
- 238
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 10
Description
Currently it doesn't seem possible to run the `mpi-operator` in a **subset** of namespaces. It's either **all** namespaces or a **specific (single)** namespace.
This limitation looks like it comes from Kubernetes itself, where [generated] _Informers_ are either scoped to a single namespace using `.WithNamespace(...)`, or if no namespace is provider, defaults to `metav1.NamespaceAll`.
An example (real-world) use-case for running the `mpi-operator` in subset of namespaces is when it's deployed to a Kubernetes cluster with tightly controlled cluster-wide permissions. E.g. when obtaining cluster-wide access to `Secrets` is non-starter. In such a case, it's still possible to create a namespace-local `RoleBinding`, whereby access can be granted to the _Service Account_ running the `mpi-operator` for namespace-local secrets. However, because the `mpi-operator` operates only in either all namespaces or a single namespace, using namespace-local `RoleBindings` isn't expandable beyond a single namespace.
Contributor guide
Research direction
Start by tracing the generated informer setup, especially the namespace handling around WithNamespace(...) and metav1.NamespaceAll. Review how the mpi-operator's Kubernetes permissions are defined for namespace-local RoleBindings. Done means the operator can watch and reconcile a configured subset of namespaces without requiring cluster-wide access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100