fix(backend): the metacontroller is broken since kubeflow#11474 (kubeflow#11608)

* Update cluster-role-binding.yaml

Signed-off-by: Julius von Kohout <[email protected]>

* Create cluster-role.yaml

Signed-off-by: juliusvonkohout <[email protected]>

* Update kustomization.yaml

Signed-off-by: juliusvonkohout <[email protected]>

* Update stateful-set.yaml

Signed-off-by: juliusvonkohout <[email protected]>

---------

Signed-off-by: Julius von Kohout <[email protected]>
Signed-off-by: juliusvonkohout <[email protected]>

Author: juliusvonkohout

manifests/kustomize/third-party/metacontroller/base/cluster-role-binding.yaml

@@ -5,7 +5,7 @@ metadata:
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: ClusterRole
-  name: cluster-admin
+  name: kubeflow-metacontroller
 subjects:
 - kind: ServiceAccount
   name: meta-controller-service

manifests/kustomize/third-party/metacontroller/base/cluster-role.yaml

@@ -0,0 +1,26 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: kubeflow-metacontroller
+rules:
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["secrets", "configmaps"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["apps"]
+  resources: ["deployments"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: [""]
+  resources: ["services"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["networking.istio.io"]
+  resources: ["destinationrules"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["security.istio.io"]
+  resources: ["authorizationpolicies"]
+  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+- apiGroups: ["metacontroller.k8s.io"]
+  resources: ["compositecontrollers", "controllerrevisions", "decoratorcontrollers"]
+  verbs: ["get", "list", "watch"]

manifests/kustomize/third-party/metacontroller/base/kustomization.yaml

@@ -2,13 +2,13 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kubeflow
 resources:
+- cluster-role.yaml
 - cluster-role-binding.yaml
 - crd.yaml
 - service-account.yaml
 - stateful-set.yaml
 commonLabels:
   kustomize.component: metacontroller
-
 # Update metacontroller CRD:
 # Copy the upstream file to crd.yaml in this folder.
-# Upstream file: https://github.com/metacontroller/metacontroller/blob/master/manifests/production/metacontroller-crds-v1.yaml
+# Upstream file: https://github.com/metacontroller/metacontroller/blob/master/manifests/production/metacontroller-crds-v1.yaml

manifests/kustomize/third-party/metacontroller/base/stateful-set.yaml

@@ -41,7 +41,7 @@ spec:
             privileged: false
             allowPrivilegeEscalation: false
           name: metacontroller
-          image: 'ghcr.io/metacontroller/metacontroller:v4.11.21'
+          image: 'ghcr.io/metacontroller/metacontroller:v2.6.1'
       serviceAccountName: meta-controller-service
   # Workaround for https://github.com/kubernetes-sigs/kustomize/issues/677
   volumeClaimTemplates: []