Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(helmchart): Extend helm chart to include automount toggle for service account #1419

Open
wants to merge 13 commits into
base: main
Choose a base branch
from

Conversation

vakaobr
Copy link

@vakaobr vakaobr commented Jul 30, 2024

Reason for Change:

  • Depending of the security controls in place on the cluster, service accounts may have the automountServiceAccountToken property set to false, but setting this to false introduces the need to set the property to true explicitly inside the deployment, in order to have the token/certs mounted to the pods.

Requirements

  • squashed commits
  • included documentation
  • added unit tests and e2e tests (if applicable).

Issue Fixed:

Please answer the following questions with yes/no:

Does this change contain code from or inspired by another project? If so, did you notify the maintainers and provide attribution?

  • yes
  • no

Notes for Reviewers:

  • In current state, when deploying the current chart to a cluster with policies to prevent service account automount, it fails. Since the pod do not mount the secret the pods fails to start with:
{"level":"error","timestamp":"2024-07-30T10:00:27.548370Z","logger":"controller-runtime.client.config","caller":"/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.17.5/pkg/client/config/config.go:133$config.loadConfig.func1","message":"unable to load in-cluster config","error":"open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory"}

… for service account

Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
@vakaobr vakaobr changed the title Extend helm chart to create secret token and include automount toggle… chore: Extend helm chart to create secret token and include automount toggle for service account Jul 30, 2024
@vakaobr
Copy link
Author

vakaobr commented Jul 30, 2024

@microsoft-github-policy-service agree

… for service account

Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
… for service account

Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
@vakaobr vakaobr changed the title chore: Extend helm chart to create secret token and include automount toggle for service account chore: Extend helm chart to include automount toggle for service account Jul 30, 2024
@vakaobr vakaobr marked this pull request as ready for review July 30, 2024 11:43
@vakaobr vakaobr requested review from aramase and enj as code owners July 30, 2024 11:43
… for service account

Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
… for service account

Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
… for service account

Signed-off-by: Anderson Leite <anderson.leite@movingimage.com>
@vakaobr
Copy link
Author

vakaobr commented Aug 14, 2024

Hey @aramase @enj maybe you folks want to have a look on this one? Thanks :)

@vakaobr vakaobr changed the title chore: Extend helm chart to include automount toggle for service account feat: Extend helm chart to include automount toggle for service account Sep 5, 2024
@vakaobr vakaobr changed the title feat: Extend helm chart to include automount toggle for service account feat(helmchart): Extend helm chart to include automount toggle for service account Sep 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant