Kubernetes model deployment permissions issue

[dipayan90]

I see this as a common scenario where in organizations that use a k8s cluster with multi tenancy. Usually every team within the Org is given admin ClusterRole permissions. Now using the admin role, one has permissions to get, delete, update, list deployments but not the status sub-resource. The admin role permissions do not let you write deployment status. They let you create and delete the deployment objects, controlling the "spec" portion of the object. Status modification permissions are granted to the deployment controller.

When deploying a model clipper relies on getting the available replicas here:

clipper/clipper_admin/clipper_admin/kubernetes/kubernetes_container_manager.py

Line 392 in 3c5a1cc

while self._k8s_beta.read_namespaced_deployment_status(

Now a namespace admin will not have access to status sub resource. However the information about number of available replicas can be obtained by just calling the https://github.com/kubernetes-client/python/blob/master/kubernetes/docs/ExtensionsV1beta1Api.md#read_namespaced_deployment as well . the status subresource doesn't give you any more information than simply fetching the deployment

It will be great if the switch is made to using the read_namespaced_deployment api endpoint instead of the read_namespaced_deployment_status endpoint.

[withsmilo]

Interesting point!
@simon-mo : What do you think of this issue?

[dipayan90]

@withsmilo @simon-mo Also another question is there a reason why NodePort was used as the K8s ServiceType instead of LoadBalancer ?

[simon-mo]

@dipayan90
For using read_namespaced_deployment api:

• Yes this will be great!
• We don't have much experience implement Clipper with permission control. We will probably start with exploring RBAC for prometheus.

For NodePort instead of LoadBalancer:

• When we started implementing it, we found NotePort is sufficient. But we should probably switch to LoadBalancer for production usage.
• As I undestand, Loadbalancer requires external IP address when it's deployed in a real K8s cluster. This requires a bit more special handling on Clipper side as well.

[withsmilo]

@dipayan90 Fixed. Thanks! These commits will be contained within next release.