fix(kueue): Add rbac for sorcerer

values/kueue/manifests/sorcerer-queue-access.yaml

@@ -2,8 +2,8 @@
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: beta-sorcerer-dev-queue
-  namespace: dev-queue
+  name: beta-sorcerer-prod-queue
+  namespace: prod-queue
 rules:
 - apiGroups:
   - jobset.x-k8s.io
@@ -27,12 +27,12 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: beta-sorcerer-dev-queue
-  namespace: dev-queue
+  name: beta-sorcerer-prod-queue
+  namespace: prod-queue
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: beta-sorcerer-dev-queue
+  name: beta-sorcerer-prod-queue
 subjects:
 - kind: ServiceAccount
   name: beta-sorcerer
@@ -41,8 +41,8 @@ subjects:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: prod-sorcerer-dev-queue
-  namespace: dev-queue
+  name: prod-sorcerer-prod-queue
+  namespace: prod-queue
 rules:
 - apiGroups:
   - jobset.x-k8s.io
@@ -66,12 +66,12 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: prod-sorcerer-dev-queue
-  namespace: dev-queue
+  name: prod-sorcerer-prod-queue
+  namespace: prod-queue
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
-  name: prod-sorcerer-dev-queue
+  name: prod-sorcerer-prod-queue
 subjects:
 - kind: ServiceAccount
   name: prod-sorcerer

values/sorcerer/kustomize/beta-ekman/deployment_patch.yaml

@@ -11,4 +11,9 @@
   value:
     secretRef:
       name: prod-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: beta-sorcerer-kueue-config
 

values/sorcerer/kustomize/beta-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: beta-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "prod-queue"
+  KUEUE_ARCHIVE_PVC: "prod-queue-ceph-archives"

values/sorcerer/kustomize/beta-ekman/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/beta-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - beta-sorcerer-appsettings
+  - beta-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/kustomize/prod-ekman/deployment_patch.yaml

@@ -11,4 +11,9 @@
   value:
     secretRef:
       name: prod-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: prod-sorcerer-kueue-config
 

values/sorcerer/kustomize/prod-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: prod-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "prod-queue"
+  KUEUE_ARCHIVE_PVC: "prod-queue-ceph-archives"

values/sorcerer/kustomize/prod-ekman/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/prod-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - prod-sorcerer-appsettings
+  - prod-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding

values/sorcerer/kustomize/staging-ekman/deployment_patch.yaml

@@ -11,4 +11,9 @@
   value:
     secretRef:
       name: staging-sorcerer-env
+- op: add
+  path: /spec/template/spec/containers/0/envFrom/-
+  value:
+    configMapRef:
+      name: staging-sorcerer-kueue-config
 

values/sorcerer/kustomize/staging-ekman/kueue-config.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: staging-sorcerer-kueue-config
+data:
+  KUEUE_NAMESPACE: "dev-queue"
+  KUEUE_ARCHIVE_PVC: "dev-queue-ceph-archives"

values/sorcerer/kustomize/staging-ekman/kustomization.yaml

@@ -18,6 +18,7 @@ resources:
 - configurations.yaml
 - keyvault.yaml
 - rbac.yaml
+- kueue-config.yaml
 - secretstore.yaml
 - statestore.yaml
 - tracing.yaml

values/sorcerer/kustomize/staging-ekman/rbac.yaml

@@ -8,6 +8,7 @@ rules:
   - ""
   resourceNames:
   - staging-sorcerer-appsettings
+  - staging-sorcerer-kueue-config
   resources:
   - configmaps
   verbs:
@@ -23,6 +24,24 @@ rules:
   verbs:
   - get
   - watch
+- apiGroups:
+  - jobset.x-k8s.io
+  resources:
+  - jobsets
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  - pods/log
+  verbs:
+  - get
+  - list
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding