New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

non-cluster-admin user can't get rayclusters resource #48

Open

j4ckstraw opened this issue Dec 2, 2024 · 0 comments · May be fixed by #50

j4ckstraw commented Dec 2, 2024

I'm a ray developer, we deploy kuberay in kubernetes platform, cluster admin run helm install xxx installed kuberay-operator for us, but we account the follow error:

$ kubectl get rayclusters
Error from server (Forbidden): rayclusters.ray.io is forbidden: User "<user>" cannot list resource "rayclusters" in API group "ray.io" in the namespace "<namespace>"

according to https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles, may helm chart clusterrole need aggregated labels to support this.

metadata:
  labels:
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"

The text was updated successfully, but these errors were encountered:

j4ckstraw pushed a commit to j4ckstraw/kuberay-helm that referenced this issue


          feat: add aggregated label to cluster role

01fb902

fix ray-project#48

see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings

Signed-off-by: wanglijie6 <[email protected]>

j4ckstraw mentioned this issue

feat: add aggregated label to cluster role #49

Closed

j4ckstraw pushed a commit to j4ckstraw/kuberay-helm that referenced this issue


          feat: add aggregated label to cluster role

342680b

fix ray-project#48

see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings

Signed-off-by: j4ckstraw <[email protected]>

j4ckstraw added a commit to j4ckstraw/kuberay-helm that referenced this issue


          feat: add aggregated label to cluster role

ecfb326

fix ray-project#48

see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings

Signed-off-by: j4ckstraw <[email protected]>

j4ckstraw linked a pull request

that will close this issue

feat: add aggregated label to cluster role #50

Open

j4ckstraw added a commit to j4ckstraw/kuberay-helm that referenced this issue


          feat: add aggregated label to cluster role

9b71919

fix ray-project#48

see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#aggregated-clusterroles
see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#default-roles-and-role-bindings

Signed-off-by: j4ckstraw <[email protected]>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment