Skip to content

Support more fine-grained access control #4147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Hcryw opened this issue Mar 26, 2025 · 4 comments · May be fixed by #4174
Open

Support more fine-grained access control #4147

Hcryw opened this issue Mar 26, 2025 · 4 comments · May be fixed by #4174
Labels
kind/feature Categorizes issue or PR as related to a new feature.

Comments

@Hcryw
Copy link

Hcryw commented Mar 26, 2025

What is the problem you're trying to solve

In multi-tenant environments or scenarios with multiple user access control, we may want to provide specific permissions for different users or service accounts. So we need certain roles to help us achieve permission isolation within a Kubernetes cluster, ensuring that different users can only access the resources they need, without being able to access other resources freely.

Describe the solution you'd like

Take Kuberay as an example, two clusterroles are provided: ray_rayjob_editor_role and ray_rayjob_viewer_role, the former allows editing rayjobs, while the latter can only query rayjobs.

https://github.com/ray-project/kuberay/blob/master/helm-chart/kuberay-operator/templates/ray_rayjob_editor_role.yaml

https://github.com/ray-project/kuberay/blob/master/helm-chart/kuberay-operator/templates/ray_rayjob_viewer_role.yaml

So we wonder if we can add certain clusterroles in Volcano to support more fine-grained access control.

Additional context

No response

@Hcryw Hcryw added the kind/feature Categorizes issue or PR as related to a new feature. label Mar 26, 2025
@Monokaix
Copy link
Member

Do you mean add built-in clusterroles and so users can use them go generate different access?

@Hcryw
Copy link
Author

Hcryw commented Apr 2, 2025

Do you mean add built-in clusterroles and so users can use them go generate different access?

Yes,we may then create clusterrolebindings to bind to certain users in our clusters.

@JesseStutler
Copy link
Member

I think we can enhance it

@Hcryw Hcryw linked a pull request Apr 3, 2025 that will close this issue
@Hcryw
Copy link
Author

Hcryw commented Apr 3, 2025

I think we can enhance it

That's great, here is the PR: #4174

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants