Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

requestloadbalancer does not apply specified service account #1210

Closed
tiny-pangolin opened this issue Jan 7, 2025 · 0 comments
Closed

requestloadbalancer does not apply specified service account #1210

tiny-pangolin opened this issue Jan 7, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@tiny-pangolin
Copy link
Contributor

If you specify a serviceAccountName in under VMCluster.spec.requestsLoadBalancer.spec it doesn't add the service account to the vmauth pods it creates. This issue does not occur if the service account is allowed to be created automatically, but this deployment is not allowed use automated service accounts. This is happening on version 0.50 of the operator running as a part of victoriametrics-k8s-stack
f41gh7 added a commit that referenced this issue Jan 8, 2025
@f41gh7
build/vmcluster: properly mount ServiceAccount for vmauth load-bala…
735425a 
…ncer

Initially `ServiceAccount` wasn't defined for `vmauth`'s `Deployment`. Since there was no practial use for it.
At older versions of operator it made sense to mount `serviceAccount` for `vminsert` and `vmselect` components because of `PodSecurityPolicy`
Kubernetes resources. But it's deprecated now and it makes `serviceAccount` irrelevant for these components.

 But for production use cases it could be useful. Strict security policy may require to disable auto service account mount.
On of possible solutions for it to use `ServiceAccount` with disabled auto-mount option.

 This commit adds `serviceAccount` of `VMCluster` to the load-balancer `Deployment`.

 Related issue:
#1210

Signed-off-by: f41gh7 <[email protected]>
@f41gh7 f41gh7 added bug Something isn't working waiting for release The change was merged to upstream, but wasn't released yet. and removed waiting for release The change was merged to upstream, but wasn't released yet. labels Jan 8, 2025
@f41gh7 f41gh7 closed this as completed Jan 13, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tiny-pangolin @f41gh7