[YUNIKORN-997] Use K8s fine-grained access control for YuniKorn scheduler

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: shim - kubernetes
• Labels: pull-request-available
• Target Version: 1.0.0
• Assignee: Craig Condit
• Reporter: Wilfred Spiegelenburg
• Created: 05/Jan/22 23:22
• Updated: 04/May/22 23:52
• Resolved: 09/Mar/22 20:35

Description

Currently we run with cluster-admin privileges. That is really broad. Kubernetes has more limited roles called system:kube-scheduler and system:volume-scheduler. Those roles are assigned to the default scheduler.

These roles will not fit for us as we do a little more than the default scheduler when it comes down to placeholder pods.
We need to assess if we can drop as many privileges as possible and not run with cluster admin role. 

Issue Links

• relates to: YUNIKORN-995 Use v1 for ClusterRoleBinding rbac.authorization.k8s.io instead of v1beta1
• links to: GitHub Pull Request #84