feat(federation): add minimal edge-scoped ClusterRole for cell write-back#167
Open
scotwells wants to merge 1 commit into
Open
feat(federation): add minimal edge-scoped ClusterRole for cell write-back#167scotwells wants to merge 1 commit into
scotwells wants to merge 1 commit into
Conversation
scotwells
force-pushed
the
feat/compute-cell-federation-rbac
branch
from
faf0ae2 to
0dc108f
Compare
…back The edge (cell) compute-manager authenticates to the hub Karmada control plane with a dedicated client-cert identity (system:compute-edge-federation@compute.datumapis.com) to write Instance status back for its cell. Grant it a new, least-privilege ClusterRole rather than the broad compute-manager role the management plane uses. The role is scoped to exactly what the cell InstanceReconciler's FederationClient does on the hub (Finalize + writeBackToUpstream): read the federation namespace, and create/update/delete its own Instance plus update its status. The cell uses a direct (non-caching) client, so no list/watch — and it never touches configmaps/secrets, workloaddeployments, or propagationpolicies on the hub. Bound to the identity by CN specifically, not the broad compute.datumapis.com group, so only this identity receives the edge role. Ships in the existing downstream-rbac kustomization so it applies to Karmada alongside the management role. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
scotwells
force-pushed
the
feat/compute-cell-federation-rbac
branch
from
0dc108f to
6d508be
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The edge (cell) compute-manager authenticates to the hub Karmada control plane with a dedicated client-cert identity (
system:compute-edge-federation@compute.datumapis.com, issued by the infra deployment control plane) to write Instance status back for its cell. This relocates that identity's least-privilege ClusterRole into the compute repo'sconfig/base/downstream-rbac, where the rest of the compute federation RBAC lives — rather than the broadcompute-managerrole the management plane uses.config/base/downstream-rbac/edge-federation-rbac.yaml:compute-edge-federation— scoped to exactly what the cell'sInstanceReconcilerFederationClient does on the hub.compute.datumapis.comgroup), so only this identity receives the edge role.Ships in the existing
downstream-rbackustomization, so it applies to Karmada alongside the management-planecompute-managerrole.Scope, derived from the code
The cell reaches the hub only through
InstanceReconciler.FederationClient, and only inFinalize+writeBackToUpstream(internal/controller/instance_controller.go:1006-1155). It is a direct (non-caching) client (cmd/main.go:268,291), andSetupWithManager's watches are all on the local/managed cell clusters — so no list/watch on the hub. Complete hub operation set:namespacesgetcompute.datumapis.com/instancesget, create, update, deletecompute.datumapis.com/instances/statusupdateNothing else — no configmaps/secrets, no workloaddeployments, no propagationpolicies (those are management-plane concerns in the broad role).
The role as written also carries
patchon instances andget,patchon instances/status. Those are not exercised by the code (the functional minimum is the table above), but they mirror the role first shipped in infra#3202 exactly, so relocating it here is a faithful, thrash-free move rather than a competing same-named role.patchis a partial-update peer ofupdate; happy to shave it (andstatus:get) to the literal minimum as a trivial follow-up once the move settles.Related & ordering
clusters/production/apps/compute-karmada.yamlso this role reaches the prod hub the edge cells federate to.system:compute-edge-federation@compute.datumapis.comwas added in infra#3202 (already merged).compute-kustomizeOCI artifact publish before infra#3206 lands, so this role is applied to the hub before infra#3206 removes the post-install copy. Because the two roles are byte-identical, any brief overlap is a no-op rather than a conflict.