terascope
Kubernetes Authentication Options
We should fully explore our options for properly configuring the teraslice k8s management user. The Spark on kubernetes documentation does a good job of explaining our options:
https://spark.apache.org/docs/2.3.0/running-on-kubernetes.html#kubernetes-features
The most straight forward option would be to place the teraslice cluster into a dedicated namespace and grant the default ServiceAccount the cluster-admin role in that namespace.
Another option, we can create a specific ServiceAccount in the specified namespace and ensure that the proper roles get created and bound to that account.
Or as described in the Spark documentation, we should allow the use of the default namespace if an explicit namespace is not provided. And use the default ServiceAccount in the effective namespace if an explicit ServiceAccount is not specified. Of course this makes communicating the proper RBAC configuration for k8s harder, but it's the right thing for the code to do.
Note that at this point, we've added support for namespaces, and the current expectation is that the default serviceaccount for that namespace has all permissions in that namespace.