kubernetes / kubernetes/perf-tests

Stop creating role bindings for system:anonymous

Open
#3,090 7 comments 0 reactions 0 assignees View on GitHub
kind/feature lifecycle/frozen
Dominant language
Go
Stars
989
Forks
654
Avg merge
3d 12h
Merged PRs (30d)
56

Description

**What would you like to be added**:

Today, there's at least one place in clusterloader2 ([xref](https://github.com/kubernetes/perf-tests/blob/6ec633314941e74d8d8e31c83ac8711e7c3d9832/clusterloader2/pkg/prometheus/prometheus.go#L379)) in which we create role bindings to `system:anonymous`.

Can we alter clusterloader2 to stop doing this?

**Why is this needed**:

Two reasons:
1. Creating bindings to `system:anonymous` is generally a bad practice, even if in this particular case the role being bound only allows read permissions.
2. Some k8s distros reject such actions by default, thus making it harder to utilize clusterloader2.

Contributor guide

Open the contributing guide

Research direction

Start at clusterloader2/pkg/prometheus/prometheus.go around line 379, where the issue identifies creation of a role binding to system:anonymous. Trace the surrounding clusterloader2 flow to determine the affected setup, then verify that clusterloader2 no longer creates that binding and remains usable on distributions that reject it.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
tooling
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.