allow more flexible rbac of mpi jobs

[rongou]

Right now we create a new Role/ServiceAccount/RoleBinding for every MPIJob. Should give cluster admin the option to reuse existing RBAC resources. Need to change to code and add params to the ksonnet prototype.

From @everpeace:

Sometimes, cluster-admin wanted to manage RBAC related resources on their own or to use existing service account. In the case, admins don't want to let the prototype create them. So,

How about introducing rbacCreate and serviceAccountName parameters?? It's popular way in helm packages. In this case, we need explicit guidance so that admins can refer to required roles when they choose rbacCreate=false.

[ldd91]

I deployed MPIJob using Role in my own namespaces however it failed,but when i used the clusterrole it succeed.My question is how to set RBAC in cluster when using MPIJob.

[everpeace]

MPIJob is expanded StatefulSets and pods owned by the statefulsets run with the dedicated serviceaccount for the MPIJob, which is created in your namespace by MPI operator.

So, I believe that you just need permission to C-R-U-D for MPIJob CRDs.

[rongou]

If you look at https://github.com/kubeflow/mpi-operator/blob/master/deploy/2-rbac.yaml, it shows all the permissions you need.

[ldd91]

Thank you for timely reply.I will have a try.@rongou @everpeace