Can't fetch Kubernetes Secrets - ServiceAccount is set to default instead of karavan

[dpalinic]

How to reproduce:

1. Create new integration
2. Create bean and load some value using the Kubernetes Secrets modal
3. Run integration
4. Observe issue below

Issue:
Caused by: io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: GET at: https://10.43.0.1:443/api/v1/namespaces/dev/secrets/dev-postgresql. Message: secrets "dev-postgresql" is forbidden: User "system:serviceaccount:dev:default" cannot get resource "secrets" in API group "" in the namespace "dev". Received status: Status(apiVersion=v1, code=403, details=StatusDetails(causes=[], group=null, kind=secrets, name=dev-postgresql, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=secrets "dev-postgresql" is forbidden: User "system:serviceaccount:dev:default" cannot get resource "secrets" in API group "" in the namespace "dev", metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Forbidden, status=Failure, additionalProperties={}).

Notes:
It looks like ServiceAccount is set to default instead of karavan. We found file in which serviceAccount is defined, but we're not sure if it's anywhere applied. Might be related to that?

File:
karavan-web/karavan-app/src/main/resources/snippets/deployment.jkube.yaml

Bean example:

- beans: - constructors: {} name: PostgresqlDeadletterDataSource properties: url: jdbc:postgresql://dev-postgresql.dev.svc.cluster.local:5432/db username: '{{secret:dev-postgresql-username/username}}' password: '{{secret:dev-postgresql/password}}' driverClassName: org.postgresql.Driver type: org.apache.commons.dbcp2.BasicDataSource

[arheom]

There are 2 cases:

1. if you use devmode (run from the top right) - then the karavan service account should be used, from my understanding. You might need to update the karavan role, bound to the karavan service account, to allow get and list verbs on the secrets resources. If this is your case, not sure why you have another service account. Maybe karavan.builder.service.account=karavan could be set to the kubernetes-application.properties, but I assume thats for the builder.
2. If you build and deploy, then you need to assign a service account to the deployment. I recommend to create a new service account, and a new role and a new binding, so every integration runs with minimum security to function correctly. This means to add to the project: role.jkube.yaml, rolebinding.jbube.yaml and deployment.jkube.yaml. Then in the deployment to define a new serviceAccountName, which you will bind to a role, like this:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: myServiceAccountName
  namespace: myNamespace
rules:
- apiGroups:
  - ""
  resources:
  - secrets
  verbs:
  - 'get'
  - 'list'

[mgubaidullin]

I believe that karavan.devmode.service.account=karavan should help

[dpalinic]

Thanks for your inputs @arheom , @mgubaidullin . If I understand correctly, every "integrator" is now responsible to manually create those configuration file as part of their project?

[mgubaidullin]

This #1125 (comment) is not correct.

1. To configure service account for devmode/builde the following properties configured for Karavan application by setting env variables for karavan deployment, when install Karavan to k8s:
   karavan.devmode.service.account=karavan for devmode pod
   karavan.builder.service.account=karavan for builder pod

2. kubernetes-application.properties file has nothing to do with that. kubernetes-application.properties is a template for application.properties file when user create a new project.

3. Integration creates *.jkube.yaml fragments to apply project specific k8s resources or configuration. They will be applied during build and deploy process in builder pod

[git-josip]

hi @mgubaidullin, I am experiencing the same issue here.
I have already karavan.builder.service.account= karavan in application.properties but still when I build project and project is deployed on k8s I can not fetch secrets.

In code, I can see karavan.builder.service.account= karavan is used in KubernetesService in getBuilderPod but the pod which is running the project and integrations does not have setup serviceaccount: karavan and we get this issue.

Also, I can see on project creation if kubernetesService.isOpenshift() snippet file PROJECT_DEPLOYMENT_JKUBE_FILENAME which is deployment.jkube.yaml is copied to project files and there is explicitly set serviceaccount:karavan and it is applied during project pod run mvn package jib:build k8s:resource k8s:apply ....

Is it maybe needed similar logic when k8s is used, to have similar snippet file with just:

spec:
  template:
    spec:
      serviceAccount: karavan