kubeflow / kubeflow/mpi-operator

Running in a subset of namespaces

Open
#620 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
535
Forks
238
Avg merge
2d 3h
Merged PRs (30d)
10

Description

Currently it doesn't seem possible to run the `mpi-operator` in a **subset** of namespaces. It's either **all** namespaces or a **specific (single)** namespace.

This limitation looks like it comes from Kubernetes itself, where [generated] _Informers_ are either scoped to a single namespace using `.WithNamespace(...)`, or if no namespace is provider, defaults to `metav1.NamespaceAll`.

An example (real-world) use-case for running the `mpi-operator` in subset of namespaces is when it's deployed to a Kubernetes cluster with tightly controlled cluster-wide permissions. E.g. when obtaining cluster-wide access to `Secrets` is non-starter. In such a case, it's still possible to create a namespace-local `RoleBinding`, whereby access can be granted to the _Service Account_ running the `mpi-operator` for namespace-local secrets. However, because the `mpi-operator` operates only in either all namespaces or a single namespace, using namespace-local `RoleBindings` isn't expandable beyond a single namespace.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the generated informer setup, especially the namespace handling around WithNamespace(...) and metav1.NamespaceAll. Review how the mpi-operator's Kubernetes permissions are defined for namespace-local RoleBindings. Done means the operator can watch and reconcile a configured subset of namespaces without requiring cluster-wide access.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.