How to properly restrict the kueue-batch-user-rolebinding created by Open Data Hub?

[Robles234]

Hi everyone,

We are facing an issue with an Open Data Hub (ODH) installation on an OpenShift cluster.

It seems that the kueue component (apparently used to manage background jobs) is automatically creating a ClusterRole named kueue-batch-user-role, granting create permissions on jobs.batch, and a ClusterRoleBinding named kueue-batch-user-rolebinding, which binds this role to the system:authenticated group (i.e., all authenticated users).

Initially, we tried to edit the ClusterRoleBinding to bind it to a more restricted group, such as odh-admins, instead of system:authenticated, in order to improve security. However, the operator immediately reconciles and recreates the ClusterRoleBinding with the original configuration.

We noticed that the resources have annotations and/or labels indicating they are managed by the ODH operator.

Our question is:
What would be the recommended way to restrict the kueue-batch-user-rolebinding to a more specific group (like odh-admins) without the operator reverting the change?
Is there a configuration option in ODH or in the kueue setup to customize the group used for the binding, or to disable the automatic management of this specific ClusterRoleBinding?

We want to ensure that we do not compromise the functionality of ODH while tightening access control.

Thanks in advance for any help or guidance!

[Robles234]

Hi everyone, just following up on this question.
We’re still trying to find a way to properly restrict the kueue-batch-user-rolebinding without the ODH operator reverting the change.
If anyone has faced a similar issue or has suggestions on how to customize this behavior, your input would be greatly appreciated!

Thanks in advance!

[rebecagarciacoca]

Hi, following up to check if there have been any updates on this, as it's also relevant to me.

[zdtsw]

Hi @Robles234 and @rebecagarciacoca ,

you can try adding opendatahub.io/managed: 'false' in resources annotations block,
and then you can update value to e.g odh-admins.
see if this helps.