-
Notifications
You must be signed in to change notification settings - Fork 68
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use helm for pko #1073
Use helm for pko #1073
Conversation
Please rebase pull request. |
roleRef: | ||
apiGroup: rbac.authorization.k8s.io | ||
kind: ClusterRole | ||
name: cluster-admin |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a more fine grained role we could use?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I used the same role used by the PKO team: https://github.com/package-operator/package-operator/blob/f564bbba288a9e3748c871c0eaec329de2ec4cd2/config/self-bootstrap-job.yaml.tpl#L16
So I'll have to ask, if we can reduce the access.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
i think it also comes down to what packages this PKO instance will manage. as we develop a feeling about what kind of resources RVMO will bring in, we could narrow the role towards that.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Agreed, cause the service account assigned to is used by the operator during runtime.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
afaiu the slack thread with the PKO folks, they are thinking about the removal of the image pin, hence we might be able to avoid our own build in the future
What this PR does
Jira:
Link to demo recording:
Special notes for your reviewer