Add ability to configure API used for permission validation when using the permission validation pre-flight check #930
Labels
carvel accepted
This issue should be considered for future work and that the triage process has been completed
enhancement
This issue is a feature request
priority/important-longterm
Important over the long term, but may not be staffed and/or may need multiple releases to complete.
Describe the problem/challenge you have
Currently, the permission validation pre-flight check uses the
SelfSubjectAccessReview
API for performing permission validation. This API is highly accurate, but also introduces load to the API server when run against a very large set of manifests (at least one request is made per resource, but can be more depending on circumstances). I want to ensure that when using this check I am not introduce significant load against the Kubernetes API server.Describe the solution you'd like
Allow a user to configure the permission validation pre-flight check to instead use the
SelfSubjectRulesReview
API for performing permission validation. When done with a cache where the namespace is the index, this can significantly reduce load on the Kubernetes API server.This should be possible to configure through the recently added pre-flight configuration path
Anything else you would like to add:
[Additional information that will assist in solving the issue.]
Vote on this request
This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.
👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"
We are also happy to receive and review Pull Requests if you want to help working on this issue.
The text was updated successfully, but these errors were encountered: