enable pai services to access rest-server without token set by admin manually
@suiguoxin is already working on this.
Since Feb 19, 2021.
- Dominant language
- JavaScript
- Stars
- 2.7k
- Forks
- 554
- Avg merge
- 20h 42m
- Merged PRs (30d)
- 14
Description
Some PAI services, like the alert handler, and the incoming DB GCer, need to access rest-server. Thus, it always needs cluster admin to set a token manually for the service. However, this operation is kind of troublesome, and the token might be expired in the future, which is hard to monitor and will cause more work for the admin.
We can leverage k8s RBAC to better handle the rest-server token like:
-
When services start (cluster is deployed), set up a token in a secret.
-
Use RBAC to let certain OpenPAI service access the token.
-
Provide a command in
paictlto refresh the token in case it is leaked.
Potential Application of this feature:
- WebPortal abnormal jobs: refactor with tag filter
- DB GCer
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.