Controller is listing jobs but it lacks permissions

[luisyonaldo]

Hi, we are currently using goldilocks to manage VPA on our clusters. We use OPA as our authorization webhook and we see that goldilocks-controller is trying to list jobs in namespaces but it lacks the permission.

Here is an example of the SubjectAccessReview.

{
  "metadata": {},
  "spec": {
    "groups": [
      "system:serviceaccounts",
      "system:serviceaccounts:goldilocks",
      "system:authenticated"
    ],
    "resourceAttributes": {
      "namespace": "<redacted>",
      "resource": "jobs",
      "verb": "list",
      "group": "batch",
      "version": "v1"
    },
    "user": "system:serviceaccount:goldilocks:goldilocks-controller",
    "uid": "<redacted>"
  },
  "apiVersion": "authorization.k8s.io/v1",
  "status": {
    "allowed": false
  },
  "kind": "SubjectAccessReview"
}

I looked in the code and couldn't find any place where jobs are explicitly queried. So either I missed it or the k8s client has some logic that lists.watch jobs when listing/watching pods.

If the controller is expected to list the jobs, then this permission should be added to the controller clusterrole, if not, then it would be nice to know why it is making this type of request.

Let me know if I can help, thanks.

[sudermanjr]

So, this is a side effect of how we lookup any top-level controller without having to maintain separate code. We look at pods, and then find their top-level controller.

It is likely that jobs should be included in the clusterrole, but I haven't actually tested if VPA and jobs play nicely together. Would be happy to facilitate someone testing out that functionality and make PRs to cover those controller types

[luisyonaldo]

@sudermanjr thanks for the explanation.

It is likely that jobs should be included in the clusterrole, but I haven't actually tested if VPA and jobs play nicely together. Would be happy to facilitate someone testing out that functionality and make PRs to cover those controller types

That sounds good, I can also help to test if needed.

[sudermanjr]

My light testing with jobs seems to suggest that since there are not always job pods running, the VPA doesn't seem play too nicely with them.