Skip to content

Commit

Permalink
better words
Browse files Browse the repository at this point in the history
  • Loading branch information
@parkedwards
parkedwards committed Nov 6, 2024
1 parent cd24e60 commit c7d8efd
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 6 deletions.
6 changes: 3 additions & 3 deletions charts/prefect-worker/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ Please note that configuring the template via `baseJobTemplate.existingConfigMap
### Setting `.Values.worker.clusterUid`
The Prefect worker attempts to generate a unique identifier for the cluster it is running on to use as metadata for your runs. Since Kubernetes [does not provide a "cluster ID"](https://github.com/kubernetes/kubernetes/issues/44954), the worker (via [the `prefect-kubernetes` library](https://github.com/PrefectHQ/prefect/blob/5f5427c410cd04505d7b2c701e2003f856044178/src/integrations/prefect-kubernetes/prefect_kubernetes/worker.py#L835-L859)) will do so by reading the `kube-system` namespace and parsing the immutable UID.
The Prefect worker attempts to generate a unique identifier for the cluster it is running on to use as metadata for your runs. Since Kubernetes [does not provide a "cluster ID" API](https://github.com/kubernetes/kubernetes/issues/44954), the worker in this chart will do so by reading the `kube-system` namespace and parsing the immutable UID. [This mimics the functionality in the `prefect-kubernetes` library]([the `prefect-kubernetes` library](https://github.com/PrefectHQ/prefect/blob/5f5427c410cd04505d7b2c701e2003f856044178/src/integrations/prefect-kubernetes/prefect_kubernetes/worker.py#L835-L859).
> [!NOTE]
> Reading the `kube-system` namespace requires a `ClusterRole` with `get` permissions on `namespaces`, as well as a `ClusterRoleBinding` to attach it to the `ServiceAccount` used by the Prefect worker.
Expand All @@ -236,9 +236,9 @@ This chart does not offer a built-in way to assign these roles, as it does not m

> HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"namespaces \"kube-system\" is forbidden: User \"system:serviceaccount:prefect:prefect-worker\" cannot get resource \"namespaces\" in API group \"\" in the namespace \"kube-system\"","reason":"Forbidden","details":{"name":"kube-system","kind":"namespaces"},"code":403}

In many cases, these role additions may be entirely infeasible due to overall access limitations. The `prefect-kubernetes` library offers an override via the `PREFECT_KUBERNETES_CLUSTER_UID` environment variable, which is set in this chart through the `.Values.worker.clusterUid` value.
In many cases, these role additions may be entirely infeasible due to overall access limitations. This chart offers a hard-coded override via the `.Values.worker.clusterUid` value.

Set this value to an arbitrary, unique ID - this bypasses the `kube-system` namespace read and utilizes your provided value as the cluster ID instead. Be sure to set this value consistently across your Prefect deployments that interact with the same cluster
Set this value to a user-provided unique ID - this bypasses the `kube-system` namespace lookup and utilizes your provided value as the cluster ID instead. Be sure to set this value consistently across your Prefect deployments that interact with the same cluster

```yaml
worker:
Expand Down
6 changes: 3 additions & 3 deletions charts/prefect-worker/README.md.gotmpl
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ Please note that configuring the template via `baseJobTemplate.existingConfigMap

### Setting `.Values.worker.clusterUid`

The Prefect worker attempts to generate a unique identifier for the cluster it is running on to use as metadata for your runs. Since Kubernetes [does not provide a "cluster ID"](https://github.com/kubernetes/kubernetes/issues/44954), the worker (via [the `prefect-kubernetes` library](https://github.com/PrefectHQ/prefect/blob/5f5427c410cd04505d7b2c701e2003f856044178/src/integrations/prefect-kubernetes/prefect_kubernetes/worker.py#L835-L859)) will do so by reading the `kube-system` namespace and parsing the immutable UID.
The Prefect worker attempts to generate a unique identifier for the cluster it is running on to use as metadata for your runs. Since Kubernetes [does not provide a "cluster ID" API](https://github.com/kubernetes/kubernetes/issues/44954), the worker in this chart will do so by reading the `kube-system` namespace and parsing the immutable UID. [This mimics the functionality in the `prefect-kubernetes` library]([the `prefect-kubernetes` library](https://github.com/PrefectHQ/prefect/blob/5f5427c410cd04505d7b2c701e2003f856044178/src/integrations/prefect-kubernetes/prefect_kubernetes/worker.py#L835-L859).

> [!NOTE]
> Reading the `kube-system` namespace requires a `ClusterRole` with `get` permissions on `namespaces`, as well as a `ClusterRoleBinding` to attach it to the `ServiceAccount` used by the Prefect worker.
Expand All @@ -236,9 +236,9 @@ This chart does not offer a built-in way to assign these roles, as it does not m

> HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"namespaces \"kube-system\" is forbidden: User \"system:serviceaccount:prefect:prefect-worker\" cannot get resource \"namespaces\" in API group \"\" in the namespace \"kube-system\"","reason":"Forbidden","details":{"name":"kube-system","kind":"namespaces"},"code":403}

In many cases, these role additions may be entirely infeasible due to overall access limitations. The `prefect-kubernetes` library offers an override via the `PREFECT_KUBERNETES_CLUSTER_UID` environment variable, which is set in this chart through the `.Values.worker.clusterUid` value.
In many cases, these role additions may be entirely infeasible due to overall access limitations. This chart offers a hard-coded override via the `.Values.worker.clusterUid` value.

Set this value to an arbitrary, unique ID - this bypasses the `kube-system` namespace read and utilizes your provided value as the cluster ID instead. Be sure to set this value consistently across your Prefect deployments that interact with the same cluster
Set this value to a user-provided unique ID - this bypasses the `kube-system` namespace lookup and utilizes your provided value as the cluster ID instead. Be sure to set this value consistently across your Prefect deployments that interact with the same cluster

```yaml
worker:
Expand Down

0 comments on commit c7d8efd

Please sign in to comment.