Gatekeeper policy to replace deprecated IAMPolicy Controller #453
Conversation
| severity: low | ||
| --- | ||
| apiVersion: cluster.open-cluster-management.io/v1beta1 | ||
| kind: Placement |
There was a problem hiding this comment.
Thanks for using placement instead of placementrule. For new policies we are planning on not delivering the placement or placementbinding in the donated policy. Curious if you have feedback regarding that too.
There was a problem hiding this comment.
I think not delivering the placement is the correct way to go. The placements make it feel like it is a complete working solution when the user would still need to create the namespace binding. I think we see a lot of issues pop up from that binding missing.
There was a problem hiding this comment.
Thanks for the feedback. Can you confirm you intended to say you think we should continue to provide the binding and a placement?
There was a problem hiding this comment.
I agree to the plan to not deliver the placement and binding. I left them here since that plan is not final. I can remove them if we want to start now with not delivering them. I was expecting you would want to have a formal notice and documentation before it was implemented.
Signed-off-by: Brian Jarvis <[email protected]>
brian-jarvis
force-pushed
the
gatekeeper-iam-limit
branch
from
cb703b7 to
5f8e9a7
Compare
|
/cc @dhaiducek @yiraeChristineKim |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: brian-jarvis, gparvin The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
To me looks great!! wow, curious Do a lot of customers want to limit clusterbinding numbers? |
openshift-merge-bot
bot
merged commit 89fe5a3
into
open-cluster-management-io:main
This Gatekeeper Policy is intended to match the behavior of the deprecated ACM IAMPolicy Controller.
It will allow an administrator to monitor and alert if
ClusterRoleBindingswith the specifiedClusterRoleexceed the maximum number of users. In the case where a Group is specified in theClusterRoleBindingthe number of users in the group are counted. ServiceAccounts are ignored.