Remove unnecessary RBAC rule for mpijobs-admin***

[vishvajit79]

Update cluster-role.yaml to remove the unnecessary RBAC rule for mpijobs-admin.

Hello,

Thank you for reviewing this PR. I have removed the line rbac.authorization.kubeflow.org/aggregate-to-kubeflow-mpijobs-admin: "true" from the clusterrole as it was overriding the kubeflow-mpijobs-admin role with the kubeflow-mpijobs-edit role.

To clarify, the rbac.authorization.kubeflow.org/aggregate-to-kubeflow-mpijobs-admin annotation is used to aggregate the kubeflow-mpijobs-admin role to the kubeflow-mpijobs namespace. However, the previous implementation of this annotation was overriding the kubeflow-mpijobs-admin role with the kubeflow-mpijobs-edit role, which is more restrictive.

By removing this line, we are restoring the intended behavior of the kubeflow-mpijobs-admin role, allowing users with this role to manage MPI jobs in the kubeflow-mpijobs namespace.

Thank you for your attention to this matter.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign alculquicondor for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[alculquicondor]

why remove this? An admin might need to perform edits in case of emergencies.

[vishvajit79]

If that's the case, then we should define rules for admin. Right now, rules for admin are empty array and when the admin annotation is added to edit clusterrole, it keeps overriding admin role. If we expect the admin to have slightly different role than edit then it would make sense to keep both otherwise I would suggest removing the admin role

[alculquicondor]

@terrytangyuan @rongou which practices are you following in the training-operator?
I don't have all the context to make a decision here.

[tenzen-y]

@alculquicondor IIRC, The training-operator doesn't use RBAC aggregations: https://github.com/kubeflow/training-operator/blob/2eff94ea8131879c7175ba6ae9e3d7d098f92f85/manifests/base/rbac/role.yaml

I guess that this setting seems to be only for the MPIJob v2.

[alculquicondor]

but these rules were added before we created the v2. So I'm not really sure what's the context.

[tenzen-y]

It makes sense. Actually, I also don't have any context...

[vishvajit79]

I don't see any relation to admin rule anywhere in the code. I think it is safe to delete all together but I'd leave that decision to you.

[vishvajit79]

Should we merge this PR? If not then I will close it

[alculquicondor]

Maybe @johnugeorge has some context of the original intent?

[terrytangyuan]

I don't have context either. I wonder if it's for integration with UI or some other front-ends.