Skip to content

fix(controller): clean retained workspace namespace metadata #433

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Kevin Cho (chokevin) merged 15 commits into from
Oct 27, 2026
+1,904 −31
Merged

fix(controller): clean retained workspace namespace metadata #433

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
03b9f91
fix(controller): clean retained workspace namespace metadata
chokevin Oct 20, 2026
46151fd
test(controller): align retarget deletion expectation
chokevin Oct 20, 2026
0a391ac
fix(controller): preserve active queue routing metadata
chokevin Oct 20, 2026
a1fbc7a
fix(controller): discover retained workload routes
chokevin Oct 22, 2026
af10b8d
Merge remote-tracking branch 'origin/main' into pr/433/chokevin-clean…
chokevin Oct 22, 2026
fe6f70c
fix(controller): retain workload identity during drain
chokevin Oct 22, 2026
41b1b72
fix(controller): retain identity during retarget drain
chokevin Oct 22, 2026
9ac128d
Merge remote-tracking branch 'origin/main' into pr/433/chokevin-clean…
chokevin Oct 23, 2026
ecfa4b6
fix(controller): reconcile access during retarget drain
chokevin Oct 23, 2026
992f1b6
fix(controller): revoke researcher access during delete drain
chokevin Oct 24, 2026
a9236f8
fix(controller): revoke obsolete identity before retarget drain
chokevin Oct 26, 2026
1be0f57
fix(controller): recover drain access and retain source Job routes
chokevin Oct 26, 2026
f6c59da
fix(controller): retain routes for RayJobs awaiting Workloads
chokevin Oct 26, 2026
325aa53
fix(controller): retain workspace routes for RayServices
chokevin Oct 27, 2026
9283d7d
fix(controller): retain routes for queued Deployments
chokevin Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions charts/tau-core-controller/kustomize/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,15 @@ rules:
- apiGroups: ["scheduling.k8s.io"]
resources: ["priorityclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch"]
- apiGroups: ["ray.io"]
resources: ["rayjobs", "rayservices"]
verbs: ["get", "list", "watch"]
- apiGroups: ["kueue.x-k8s.io"]
resources: ["workloads"]
verbs: ["get", "list", "watch"]
Expand Down
9 changes: 9 additions & 0 deletions charts/tau-core-controller/templates/rbac.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,15 @@ rules:
- apiGroups: ["scheduling.k8s.io"]
resources: ["priorityclasses"]
verbs: ["get", "list", "watch"]
- apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch"]
- apiGroups: ["ray.io"]
resources: ["rayjobs", "rayservices"]
verbs: ["get", "list", "watch"]
- apiGroups: ["kueue.x-k8s.io"]
resources: ["workloads"]
verbs: ["get", "list", "watch"]
Expand Down
24 changes: 24 additions & 0 deletions charts/tau-core-controller/tests/rbac_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,30 @@ suite: Researcher RayService permissions
templates:
- templates/rbac.yaml
tests:
- it: grants the controller read-only source Job access for workspace drain checks
asserts:
- contains:
path: rules
content:
apiGroups: ["apps"]
resources: ["deployments"]
verbs: ["get", "list", "watch"]
documentIndex: 2
- contains:
path: rules
content:
apiGroups: ["batch"]
resources: ["jobs"]
verbs: ["get", "list", "watch"]
documentIndex: 2
- contains:
path: rules
content:
apiGroups: ["ray.io"]
resources: ["rayjobs", "rayservices"]
verbs: ["get", "list", "watch"]
documentIndex: 2

- it: grants RayJob and RayService lifecycle permissions to the researcher role
documentSelector:
path: metadata.name
Expand Down
Loading
Loading