Ability to influence serviceaccount used in created deployment about kubedock HOT 7 CLOSED

That would help. Maybe even a label which maps to the used serviceAccount?

from kubedock.

Wow! That was quick. Thanks a lot!

from kubedock.

The service account is managed by the component that deploys the container. For example, if tekton would be used to run pipelines that have kubedock running as a sidecar, you would use the serviceAccount field in the PipelineRun resource (see here). You could then create a specific service account (using the rbac example from the readme), or extend the default tekton service account with the required rbac.

from kubedock.

Hmm.. I'm not quite sure I understand. I'm running the Task with the "kubedock" serviceaccount which has all the RBAC in place to create a deployment etc (like the RBAC listed in the README). But the deployment created still creates Pods with the default serviceaccount. So for example a PostgreSQL instance which has been spinned up is running with the default serviceAccount.

from kubedock.

Check, I misunderstood. You want to influence the serviceAccount in the containers that are spun up by kubedock. That makes sense. I think something like providing a command-line argument for that would be sufficient right?

from kubedock.

Added both label com.joyrex2001.kubedock.service-account and argument --service-account.

from kubedock.

I removed the override via the label; this can allow privilege escalation via a test if there are service accounts in the namespace kubedock is running that have more privileges.

from kubedock.