Add SA option for automounting tokens #1705
Conversation
The committers listed above are authorized under a signed CLA. |
k8s-ci-robot
added
the
cncf-cla: no
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: bareksml The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Welcome @bareksml! |
|
Hi @bareksml. Thanks for your PR. I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
k8s-ci-robot
added
needs-ok-to-test
| {{- if .Values.controller.serviceAccount.create }} | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| automountServiceAccountToken: {{ .Values.controller.serviceAccount.automountServiceAccountToken }} |
There was a problem hiding this comment.
It would be better we do with check first like
{{- if .Values.node.serviceAccount.automountServiceAccountToken }}
automountServiceAccountToken: {{ .Values.node.serviceAccount.automountServiceAccountToken }}
{{- end }}
| {{- if .Values.node.serviceAccount.create }} | ||
| apiVersion: v1 | ||
| kind: ServiceAccount | ||
| automountServiceAccountToken: {{ .Values.node.serviceAccount.automountServiceAccountToken }} |
There was a problem hiding this comment.
It would be better we do with check first like
{{- if .Values.node.serviceAccount.automountServiceAccountToken }}
automountServiceAccountToken: {{ .Values.node.serviceAccount.automountServiceAccountToken }}
{{- end }}
Is this a bug fix or adding new feature?
Fix and quality of life imptovement (backport from aws-loadbalancer-controller helmchart)
What is this PR about? / Why do we need it?
Since modern k8s releases do not automount tokens one wishing to use IRSA must also create dedicated serviceaccounts outside of this helmchart. Considering the fact that values.yaml has hints covering irsa annotations lack of this parameter makes whole thing more than incoherent.
What testing is done?