Baike.dev
Log in
Back to tool/Back to issues
#138149·Kubernetes

Migrate DRA components to support granular authorization on status updates

Author: enjCreated Apr 1, 2026Updated Sep 16, 2026
Labelssig/networksig/nodesig/authhelp wantedgood first issuetriage/acceptedwg/device-management

/triage accepted /sig auth node network /wg device-management /good-first-issue

@liggitt @aojea @dims @pohly @johnbelamaric

AI generated migration guide with list of potentially impacted components.

DRA Granular Status Authorization: Migration Guide

Starting in Kubernetes v1.36, the DRAResourceClaimGranularStatusAuthorization feature gate (beta, on-by-default) enforces fine-grained authorization checks for ResourceClaim status updates. Components that previously only needed update/patch on resourceclaims/status now require additional permissions on synthetic subresources depending on which status fields they modify.

Reference: #134947, https://github.com/kubernetes/website/pull/55070

What changed

Old permission New additional permission required Who needs it
resourceclaims/status update/patch resourceclaims/binding update/patch Schedulers, allocation controllers (anything modifying status.allocation or status.reservedFor)
resourceclaims/status update/patch resourceclaims/driver associated-node:update/associated-node:patch Node-local DRA drivers (ServiceAccount bound to a specific node via pod-bound token)
resourceclaims/status update/patch resourceclaims/driver arbitrary-node:update/arbitrary-node:patch Control-plane DRA drivers, network controllers, or any component managing device status across nodes

The existing resourceclaims/status permission is still required — it remains the "front door". The new synthetic subresources are additional checks on top of it.

These new permissions can be added now in preparation for 1.36, they are inert in earlier versions of Kubernetes.

Migration by component type

Node-local DRA drivers

These run as DaemonSets with a ServiceAccount whose token is bound to the node (via a pod scheduled on that node). They update status.devices for their own driver.

Add this rule to the driver's ClusterRole:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/driver"]
  verbs: ["associated-node:update", "associated-node:patch"]
  resourceNames: ["<your-driver-name>"]  # e.g. "dra.example.com"

Keep the existing rule:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/status"]
  verbs: ["get", "update", "patch"]

Control-plane DRA drivers / multi-node controllers

These run as Deployments (not node-bound). They update status.devices for their driver from a central controller.

Add this rule to the controller's ClusterRole:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/driver"]
  verbs: ["arbitrary-node:update", "arbitrary-node:patch"]
  resourceNames: ["<your-driver-name>"]  # e.g. "dra.example.com"

Keep the existing rule:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/status"]
  verbs: ["get", "update", "patch"]

Schedulers

These modify status.allocation and status.reservedFor when binding claims to nodes.

Add this rule to the scheduler's ClusterRole:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/binding"]
  verbs: ["update", "patch"]

Keep the existing rule:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/status"]
  verbs: ["get", "update", "patch"]

Note: The built-in system:kube-scheduler ClusterRole is updated automatically by the bootstrap policy when the feature gate is enabled. Only custom schedulers need manual updates.

Operators / virtual clusters that proxy all ResourceClaim operations

These need all of the above depending on what operations they proxy.

Add both rules:

- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/binding"]
  verbs: ["update", "patch"]
- apiGroups: ["resource.k8s.io"]
  resources: ["resourceclaims/driver"]
  verbs: ["associated-node:update", "associated-node:patch", "arbitrary-node:update", "arbitrary-node:patch"]

Components that only read status or manage non-status fields

No changes needed. The new checks only apply to writes to status.allocation, status.reservedFor, and status.devices.

Projects to update

DRA Drivers

Schedulers

Virtual Clusters / Operators

Other (ResourceClaim management, not DRA)

Documentation

Source: kubernetes/kubernetes

View original on GitHubView discussion on GitHub