oxidecomputer / oxidecomputer/cluster-api-provider-oxide
Namespace Scoping
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2
- Forks
- 1
- Avg merge
- 3h 57m
- Merged PRs (30d)
- 6
Description
In order for Cluster API to support provisioning clusters across namespaces that require unique cloud credentials and to write guest cluster credentials, Secret RBAC permissions are scoped broadly cluster-wide. Generally, Cluster API and providers are operated in a trusted context (i.e. the management cluster). However, there are strategies to run Cluster API controllers per tenant namespace to scope down Secrets access.
To support namespace scoped CAPOx, we would need to implement a flag on the controller that tells CAPOx which namespace(s) to watch and replace the ClusterRole Secrets RBAC permissions to individual Role permissions for each namespace that CAPOx watches.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the CAPOx controller configuration and the ClusterRole permissions for Secrets described in the issue. Define the controller flag and namespace-watching behavior, then replace the broad permissions with Roles for watched namespaces; done means namespace-scoped provisioning and guest credential access work without cluster-wide Secret permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100