team setup for kubernetes (#16)

Author: dgrove-oss

SETUP.md

@@ -24,8 +24,8 @@ Step by step setup instructions are provided for the following versions:
 + [OpenShift AI 2.10](./setup.RHOAI-v2.10/CLUSTER-SETUP.md)
 <!---
 + [OpenShift AI 2.11](./setup.RHOAI-v2.11/CLUSTER-SETUP.md)
-+ [Kubernetes 1.25+](./setup.k8s-v1.25/CLUSTER-SETUP.md)
 --->
++ [Kubernetes 1.25+](./setup.k8s-v1.25/CLUSTER-SETUP.md)
 
 ## Team Setup
 
@@ -36,8 +36,8 @@ Step by step setup instructions are provided for the following versions:
 + [OpenShift AI 2.10](./setup.RHOAI-v2.10/TEAM-SETUP.md)
 <!---
  + [OpenShift AI 2.11](./setup.RHOAI-v2.11/TEAM-SETUP.md)
- + [Kubernetes 1.25+](./setup.k8s-v1.25/TEAM-SETUP.md)
 --->
+ + [Kubernetes 1.25+](./setup.k8s-v1.25/TEAM-SETUP.md)
 
 ## Quota Maintenance
 
@@ -91,5 +91,5 @@ and reclaim the corresponding namespaces.
 + [OpenShift AI 2.10](./setup.RHOAI-v2.10/UNINSTALL.md)
 <!---
 + [OpenShift AI 2.11](./setup.RHOAI-v2.11/UNINSTALL.md)
+--->
 + [Kubernetes 1.25+](./setup.k8s-v1.25/UNINSTALL.md)
---->

setup.RHOAI-v2.10/TEAM-SETUP.md

@@ -1,8 +1,10 @@
 # Team Setup
 
+A *team* in MLBatch is a group of users that share a resource quota.
 
-The team setup creates a project, a user group, a quota, a queue, and the
-required role bindings.
+
+Setting up a new team requires the cluster admin to create a project,
+a user group, a quota, a queue, and the required role bindings as described below.
 
 Create project:
 ```sh

setup.RHOAI-v2.11/TEAM-SETUP.md

@@ -1,8 +1,10 @@
 # Team Setup
 
+A *team* in MLBatch is a group of users that share a resource quota.
 
-The team setup creates a project, a user group, a quota, a queue, and the
-required role bindings.
+
+Setting up a new team requires the cluster admin to create a project,
+a user group, a quota, a queue, and the required role bindings as described below.
 
 Create project:
 ```sh

setup.k8s-v1.25/TEAM-SETUP.md

@@ -1,14 +1,32 @@
 # Team Setup
 
-The team setup creates a namespace, a user group, a quota, a queue, and the
-required role bindings.
+A *team* in MLBatch is a group of users that share a resource quota.
+
+Setting up a new team requires the cluster admin to create a namespace,
+a quota, a queue, and the required role bindings as described below.
 
 Create namespace:
 ```sh
 kubectl create namespace team1
 ```
 
-*** UNDER CONSTRUCTION***
+For each user on the team, create a RoleBinding:
+```sh
+kubectl -n team 1 apply -f- << EOF
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: user-one
+subjects:
+  - kind: User
+    apiGroup: rbac.authorization.k8s.io
+    name: user-one
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mlbatch-edit
+EOF
+```
 
 Specify the intended quota for the namespace by creating a `ClusterQueue`:
 ```sh

setup.k8s-v1.25/UNINSTALL.md

@@ -1 +1,21 @@
-# Under Construction!
+# Uninstall
+
+To uninstall the MLBatch controllers and reclaim the corresponding namespaces,
+do the following:
+```sh
+# Delete operators and CRDs
+kubectl delete -k setup.k8s-v1.25/appwrapper
+kubectl delete -k setup.k8s-v1.25/kueue
+kubectl delete -k setup.k8s-v1.25/kuberay
+kubectl delete -k setup.k8s-v1.25/training-operator
+
+# Delete namespace
+kubectl delete namespace mlbatch-system
+
+# Delete clusterole
+kubectl delete clusterrole mlbatch-edit
+
+# Coscheduler uninstall
+helm uninstall -n scheduler-plugins scheduler-plugins
+kubectl delete namespace scheduler-plugins
+```

setup.tmpl/TEAM-SETUP.md.tmpl

@@ -1,8 +1,10 @@
 # Team Setup
 
+A *team* in MLBatch is a group of users that share a resource quota.
+
 {{ if .OPENSHIFT }}
-The team setup creates a project, a user group, a quota, a queue, and the
-required role bindings.
+Setting up a new team requires the cluster admin to create a project,
+a user group, a quota, a queue, and the required role bindings as described below.
 
 Create project:
 ```sh
@@ -21,16 +23,31 @@ Bind cluster role to group in namespace:
 {{ .KUBECTL }} adm policy add-role-to-group mlbatch-edit team1-edit-group --role-namespace="" --namespace team1
 ```
 {{- else -}}
-The team setup creates a namespace, a user group, a quota, a queue, and the
-required role bindings.
+Setting up a new team requires the cluster admin to create a namespace,
+a quota, a queue, and the required role bindings as described below.
 
 Create namespace:
 ```sh
 {{ .KUBECTL }} create namespace team1
 ```
 
-*** UNDER CONSTRUCTION***
-
+For each user on the team, create a RoleBinding:
+```sh
+{{ .KUBECTL }} -n team 1 apply -f- << EOF
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: user-one
+subjects:
+  - kind: User
+    apiGroup: rbac.authorization.k8s.io
+    name: user-one
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mlbatch-edit
+EOF
+```
 {{- end }}
 
 Specify the intended quota for the namespace by creating a `ClusterQueue`: