Add rbac for the pytorchjobs

Signed-off-by: Yuki Iwai <yuki.iwai.tz@gmail.com>
kubernetes-sigs · Aug 9, 2023 · b384a36 · b384a36
1 parent fc23a88
commit b384a36
Show file tree

Hide file tree

Showing 6 changed files with 103 additions and 0 deletions.
diff --git a/charts/kueue/templates/rbac/pytorchjob_editor_role.yaml b/charts/kueue/templates/rbac/pytorchjob_editor_role.yaml
@@ -0,0 +1,27 @@
+# permissions for end users to edit pytorchjobs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: '{{ include "kueue.fullname" . }}-pytorchjob-editor-role'
+  labels:
+    rbac.kueue.x-k8s.io/batch-admin: "true"
+    rbac.kueue.x-k8s.io/batch-user: "true"
+rules:
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - pytorchjobs
+    verbs:
+      - create
+      - delete
+      - get
+      - list
+      - patch
+      - update
+      - watch
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - pytorchjobs/status
+    verbs:
+      - get
diff --git a/charts/kueue/templates/rbac/pytorchjob_viewer_role.yaml b/charts/kueue/templates/rbac/pytorchjob_viewer_role.yaml
@@ -0,0 +1,23 @@
+# permissions for end users to view jobs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: '{{ include "kueue.fullname" . }}-pytorchjob-viewer-role'
+  labels:
+    rbac.kueue.x-k8s.io/batch-admin: "true"
+    rbac.kueue.x-k8s.io/batch-user: "true"
+rules:
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - pytorchjobs
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - kubeflow.org
+    resources:
+      - pytorchjobs/status
+    verbs:
+      - get
diff --git a/charts/kueue/values.yaml b/charts/kueue/values.yaml
@@ -87,6 +87,7 @@ managerConfig:
       - "batch/job"
       - "kubeflow.org/mpijob"
       - "ray.io/rayjob"
+      - "kubeflow.org/pytorchjob"
 # ports definition for metricsService and webhookService.
 metricsService:
   ports:

diff --git a/config/components/rbac/kustomization.yaml b/config/components/rbac/kustomization.yaml
@@ -36,3 +36,5 @@ resources:
 - mpijob_viewer_role.yaml
 - rayjob_editor_role.yaml
 - rayjob_viewer_role.yaml
+- pytorchjob_editor_role.yaml
+- pytorchjob_viewer_role.yaml
diff --git a/config/components/rbac/pytorchjob_editor_role.yaml b/config/components/rbac/pytorchjob_editor_role.yaml
@@ -0,0 +1,27 @@
+# permissions for end users to edit pytorchjobs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pytorchjob-editor-role
+  labels:
+    rbac.kueue.x-k8s.io/batch-admin: "true"
+    rbac.kueue.x-k8s.io/batch-user: "true"
+rules:
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - pytorchjobs
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - pytorchjobs/status
+  verbs:
+  - get
diff --git a/config/components/rbac/pytorchjob_viewer_role.yaml b/config/components/rbac/pytorchjob_viewer_role.yaml
@@ -0,0 +1,23 @@
+# permissions for end users to view jobs.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pytorchjob-viewer-role
+  labels:
+    rbac.kueue.x-k8s.io/batch-admin: "true"
+    rbac.kueue.x-k8s.io/batch-user: "true"
+rules:
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - pytorchjobs
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - pytorchjobs/status
+  verbs:
+  - get