microsoft / microsoft/pai

enable pai services to access rest-server without token set by admin manually

Open
#4,934 0 comments 0 reactions 1 assignee View on GitHub

@suiguoxin is already working on this.

Since Feb 19, 2021.

pai-dev
Dominant language
JavaScript
Stars
2.7k
Forks
554
Avg merge
20h 42m
Merged PRs (30d)
14

Description

Some PAI services, like the alert handler, and the incoming DB GCer, need to access rest-server. Thus, it always needs cluster admin to set a token manually for the service. However, this operation is kind of troublesome, and the token might be expired in the future, which is hard to monitor and will cause more work for the admin.

We can leverage k8s RBAC to better handle the rest-server token like:

  1. When services start (cluster is deployed), set up a token in a secret.

  2. Use RBAC to let certain OpenPAI service access the token.

  3. Provide a command in paictl to refresh the token in case it is leaked.

Potential Application of this feature:

  • WebPortal abnormal jobs: refactor with tag filter
  • DB GCer

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.