Hello slightly smiling face I m a bit confused right now wit Flyte #flyte-deployment

Hello :slightly_smiling_face: I'm a bit confused r...

some-grass-84903

09/07/2023, 11:54 AM

Hello 🙂 I'm a bit confused right now with the permission set of the flyteadmin. To my understanding the communication of the control plane to the data plane over the flyteadmin user consists of creating workflow CRDs and getting updates on their status. I wonder then a bit why its assigned ClusterRole grants pretty broad permissions by default resulting in the following rules on the data plane:

Copy code

rules:
- apiGroups:
  - ""
  - <http://flyte.lyft.com|flyte.lyft.com>
  - <http://rbac.authorization.k8s.io|rbac.authorization.k8s.io>
  resources:
  - configmaps
  - flyteworkflows
  - namespaces
  - pods
  - resourcequotas
  - roles
  - rolebindings
  - secrets
  - services
  - serviceaccounts
  - spark-role
  verbs:
  - '*'

I get that I can overwrite those and restrict it more, but when does need the flyteadmin need more of those permissions besides the

flyteworkflows

one?

thankful-minister-83577

09/07/2023, 8:57 PM

this is because of the cluster resource controller.

thankful-minister-83577

09/07/2023, 8:57 PM

if you turn that off you can remove most of these permissions

thankful-minister-83577

09/07/2023, 8:58 PM

https://docs.flyte.org/en/latest/deployment/configuration/general.html#cluster-resources

thankful-minister-83577

09/07/2023, 8:59 PM

this bit in admin is code that will for example, create namespaces for a project when you create a new flyte project

thankful-minister-83577

09/07/2023, 8:59 PM

and make sure that the namespace has the right service accounts or whatever

thankful-minister-83577

09/07/2023, 9:00 PM

basically it’s applying these templates

thankful-minister-83577

09/07/2023, 9:08 PM

maybe it was a templating thing…

thankful-minister-83577

09/07/2023, 9:09 PM

this was our old template… but there’s an extra layer here cuz we used to have yet another templating engine on top of helm

Copy code

subject: |
                Flyte: {{{{ "{{{{" }}}} project {{{{ "}}}}" }}}}/{{{{ "{{{{" }}}} domain {{{{ "}}}}" }}}}/{{{{ "{{{{" }}}} launch_plan.name {{{{ "}}}}" }}}}: {{{{ "{{{{" }}}} phase {{{{ "}}}}" }}}}
              sender: "flyte@{parent.domain}"
              body: |
                Execution {{{{ "{{{{" }}}} workflow.project {{{{ "}}}}" }}}}/{{{{ "{{{{" }}}} workflow.domain {{{{ "}}}}" }}}}/{{{{ "{{{{" }}}} workflow.name {{{{ "}}}}" }}}}/{{{{ "{{{{" }}}} name {{{{ "}}}}" }}}} in phase {{{{ "{{{{" }}}} phase {{{{ "}}}}" }}}}.
                Details: <https://mydomain.com/console/projects/{{{{> "{{{{" }}}} project {{{{ "}}}}" }}}}/domains/{{{{ "{{{{" }}}} domain {{{{ "}}}}" }}}}/executions/{{{{ "{{{{" }}}} name {{{{ "}}}}" }}}}.
                {{{{ "{{{{" }}}} error {{{{ "}}}}" }}}}

some-grass-84903

09/08/2023, 1:09 PM

Thanks for the real helpful and insightful input! Will play a bit around with it

4 Views

Open in Slack

Previous Next