poddefaults go into wrong namespace

[lukemarsden]

This charm supports a pod-defaults relation which causes it to create pod-default objects which kubeflow notebooks respects to, for example, inject environment variables into notebooks.

These pod-defaults get created in the kubeflow namespace (or whichever namespace the juju model is configured to use, I suppose), however they need to be created in the user namespace e.g. admin in order for them to take effect.

Related code:

admission-webhook-operator/src/charm.py

Line 133 in bed7cfd

def set_pod_spec(self, event):

[DomFleischmann]

@ca-scribner How is this going to be with multiuser support?

[ca-scribner]

Sorry I missed this before. Yeah this is a funny one, as the PodDefaults are intended to be namespace specific, but it would be good to have a way for admins to put some PodDefaults in every namespace (either through this relation or something else). We do create one standard PodDefault in every user's namespace by default, but it is for kfp and hacked into the metacontroller that creates other namespaced kfp resources at the same time. It would odd to shim non-kfp PodDefaults in there

Two ideas come to mind:

• we might be able to make the admission-webhook charm's PodDefault relation "smarter", where charms could request broadly scoped PodDefaults (eg: in every namespace, in [some, list, of] namespaces, etc). Not sure what we'd do to handle RBAC (admission-webhook charm would need cluster scoped --trust to create these PodDefaults in namespaces other than kubeflow. Might also need to validate whether charm requesting the PodDefault be created is allowed, but I guess if a charm has been related to admission-webhook:PodDefault then that's an admin-level decision anyway so maybe that's ok)
• Something of a replacement for stuff like this has been discussed upstream like here for the ProfileResourceTemplate. This is a way to ask the ProfileController to make default resources that go in the namespace of any profile. That idea has been discussed, but it has not been implemented (doesn't sound hard, but needs work)