@@ -187,11 +187,10 @@ objects as privileged. This feature includes:
187
187
188
188
1. Grants privileged access to the requested device :
189
189
190
- For requests with `adminAccess : true`, the DRA controller bypasses standard
190
+ For requests with `adminAccess : true`, the scheduler bypasses standard
191
191
allocation checks and allows administrators to access devices already in use.
192
192
This ensures privileged tasks like monitoring or diagnostics can be performed
193
- without disrupting existing allocations. The controller also logs and audits
194
- admin-access requests for security and traceability.
193
+ without disrupting existing allocations.
195
194
196
195
1. No impact on availability of claims :
197
196
@@ -245,7 +244,7 @@ type DeviceRequest struct {
245
244
//
246
245
// +optional
247
246
// +featureGate=DRAAdminAccess
248
- AdminAccess *bool ` json:"adminAccess,omitempty" protobuf:"bytes,6,opt,name=adminAccess"`
247
+ AdminAccess *bool
249
248
}
250
249
` ` `
251
250
@@ -285,13 +284,12 @@ admin namespace label.
285
284
# ## Kube-controller-manager Changes
286
285
287
286
In pkg/controller/resourceclaim/controller.go, process `ResourceClaim` in
288
- ` syncClaim ` function to check for the ` adminAccess ` field and bypass standard
289
- allocation checks if ` adminAccess: true ` and log it for security and
290
- traceability.
287
+ ` syncClaim` function to check for the `adminAccess` field and the feature gate
288
+ enablement to ensure the field can be set.
291
289
292
290
// TODO : what part of claim.Status.Allocation should be updated? e.g.
293
- AdminAccess is part of DeviceRequestAllocationResult but need to set it for each
294
- device?
291
+ AdminAccess is part of ` DeviceRequestAllocationResult` but need to set it for
292
+ each device?
295
293
296
294
In pkg/controller/resourceclaim/controller.go, process requests in `handleClaim`
297
295
function to prevent creation of `ResourceClaim` when the `ResourceClaimTemplate`
@@ -301,7 +299,7 @@ has the `adminAccess` field while the feature gate is turned off.
301
299
302
300
In pkg/scheduler/framework/plugins/dynamicresources/allocateddevices.go, handle
303
301
claims with `adminAccess` to ensure devices allocated with `adminAccess` are
304
- skipped without invoking the callback.
302
+ skipped without invoking the callback bypassing standard allocation checks .
305
303
306
304
# ## ResourceQuota
307
305
0 commit comments