diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 97068f6..265c8cd 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -14,6 +14,7 @@ on: push: branches: - main + - feat-remote-pipeline # Environment variables available to all jobs and steps in this workflow env: diff --git a/cmd/rbac.go b/cmd/rbac.go index 23e8b28..fbeb2dd 100644 --- a/cmd/rbac.go +++ b/cmd/rbac.go @@ -187,31 +187,6 @@ func generateRoles(profile *kubeflowv1.Profile) []*rbacv1.Role { func generateRoleBindings(profile *kubeflowv1.Profile) []*rbacv1.RoleBinding { roleBindings := []*rbacv1.RoleBinding{} - // Grant every profile a ml-pipeline role binding - roleBinding := &rbacv1.RoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: "ml-pipeline", - Namespace: profile.Name, - OwnerReferences: []metav1.OwnerReference{ - *metav1.NewControllerRef(profile, kubeflowv1.SchemeGroupVersion.WithKind("Profile")), - }, - }, - RoleRef: rbacv1.RoleRef{ - APIGroup: rbacv1.SchemeGroupVersion.Group, - Kind: "ClusterRole", - Name: "ml-pipeline", - }, - Subjects: []rbacv1.Subject{ - { - APIGroup: "rbac.authorization.k8s.io", - Kind: "User", - Name: profile.Spec.Owner.Name, - }, - }, - } - - roleBindings = append(roleBindings, roleBinding) - // DAaaS-AAW-Support is granted "profile-support" cluster role in this namespace if len(rbacSupportGroups) > 0 { roleBinding := &rbacv1.RoleBinding{