Custom Job only queue

[ArangoGutierrez]

What would you like to be added:
In line with #65 #77 , once we define a clear path for supporting custom jobs, plugin or framework like.
We could consider blocking queues to only accept a specific type of job/workload

Why is this needed:

As a system Admin I would like to create/curate a custom job for my organization, and block users from queuing workloads outside of the "supported" framework.

[alculquicondor]

/priority longterm

can you expand on why they admins would care about the specific API? Usually they just care about what resources they consume.

Also, to create MPIJob (for example) you need to add the permission to create such objects to a Role. Isn't that enough?

[k8s-ci-robot]

@alculquicondor: The label(s) priority/longterm cannot be applied, because the repository doesn't have them.

In response to this:

/priority longterm

can you expand on why they admins would care about the specific API? Usually they just care about what resources they consume.

Also, to create MPIJob (for example) you need to add the permission to create such objects to a Role. Isn't that enough?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ArangoGutierrez]

/priority longterm

can you expand on why they admins would care about the specific API? Usually they just care about what resources they consume.

Also, to create MPIJob (for example) you need to add the permission to create such objects to a Role. Isn't that enough?

Sure.

I am not thinking from a security point of view, more like a custom resource utilization scenario + custom job. Someone could want to block a Queue for specific purposes, bc they will track that Queue on Prometheus as example.

I agree this is long term, I just had the idea and wanted to leave record of it. Maybe I am out of coffee but sounds like a good scenario to isolate Queues for specific purposes.

[ArangoGutierrez]

/priority awaiting-more-evidence

[ahg-g]

but sounds like a good scenario to isolate Queues for specific purposes.

This is discussed in the initial proposal. Apart from basic support for namespace selector in ClusterQueue (basic tenancy control), admins can use policy controllers like GateKeeper to implement more advanced scenarios.

[ArangoGutierrez]

/close

[k8s-ci-robot]

@ArangoGutierrez: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.