Evaluate how we can make SDP easier to use for users who cannot easily create cluster scoped resources

Non vengono indicati file o test. Inizia compilando l’elenco completo delle risorse SDP con ambito cluster, incluse SecretClass, ListenerClass, AuthenticationClass e SparkApplicationTemplate, quindi raccogli le alternative per gli utenti che non dispongono dell’autorizzazione a crearle. Il lavoro è considerato completato quando il risultato viene presentato al team e viene redatto un piano o un ADR che spieghi l’approccio attuale, le modifiche attuabili e gli eventuali vincoli inevitabili.

Description

[!NOTE]
This is a concern voiced by customers every once in a while. This issue serves as a way to track these requests and collect idea.

In some enterprise deployments Kubernetes clusters are managed centrally and there are strict rules about what is and what is not allowed on a cluster. Because it's a known pattern there are usually rules and processes around how to install CRDs, operators and their direct required resources (e.g. RBAC rules and other built-in resources).

Sometimes it is not however possible for the actual users / admins of our data platform to create cluster scoped resources themselves. We have a few of those in our stack (e.g. SecretClass). They were originally conceived as a way to specify certain resources cluster- or company-wide, similar to built-in things like StorageClasses. This does not always match the organisational structure where different levels of people are responsible for different things and the people responsible for deploying our SDP have no way of creating cluster scoped resources outside of the outlined processes (operator installation).

Value

We want to enable everyone to use SDP to its full extent without having to resort to overrides even if cluster scoped resources can't be created.

Tasks

• Collect a list of all custer-scoped resources in SDP
• Brainstorm/Collect ideas how SDP could work without cluster-scoped resources (that we define ourselves), if it's not possible entirely without also consider alternatives (e.g. fewer cluster-scoped ones, better documentation, ...)
• Present the outcome to the team
• If needed: Create a decision on the outcome
• Write a document (maybe an ADR) with the results

Acceptance Criteria

There is a plan (potentially an ADR) I can read which outlines how SDP deals with cluster-scoped resources now and what we could potentially change in the future to make it easier to use for people without permission to create cluster-scoped resources. If that is not possible the plan should explain why.

Details

List of cluster-scoped resources (might be incomplete) in SDP:

• SecretClass
• ListenerClass
• AuthenticationClass
• SparkApplicationTemplate