From 386f23f0280d641bb518eb1f1a88192fa4d024ff Mon Sep 17 00:00:00 2001 From: Mikkel Oscar Lyderik Larsen Date: Wed, 22 Nov 2023 15:31:01 +0100 Subject: [PATCH] Optional support for custom default service account Signed-off-by: Mikkel Oscar Lyderik Larsen --- cluster/config-defaults.yaml | 4 ++++ cluster/manifests/01-admission-control/config.yaml | 4 ++++ cluster/node-pools/master-default/userdata.yaml | 3 ++- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/cluster/config-defaults.yaml b/cluster/config-defaults.yaml index 980c128731..551dda873c 100644 --- a/cluster/config-defaults.yaml +++ b/cluster/config-defaults.yaml @@ -537,6 +537,10 @@ teapot_admission_controller_crd_role_provisioning_allowed_api_groups: "flink.k8s teapot_admission_controller_topology_spread: optin teapot_admission_controller_topology_spread_timeout: 7m +# Inject custom default service account to identify client pods using default SA +# to read from the Kubernetes API. +teapot_admission_controller_custom_default_service_account: "false" + # Enable and configure runtime-policy annotation {{if eq .Cluster.Environment "production"}} diff --git a/cluster/manifests/01-admission-control/config.yaml b/cluster/manifests/01-admission-control/config.yaml index 55cc89b093..73e259f270 100644 --- a/cluster/manifests/01-admission-control/config.yaml +++ b/cluster/manifests/01-admission-control/config.yaml @@ -52,6 +52,10 @@ data: podfactory.base-image-check.namespaces: "{{ .Cluster.ConfigItems.teapot_admission_controller_validate_base_images_namespaces }}" {{- end }} +{{- if eq .Cluster.ConfigItems.teapot_admission_controller_custom_default_service_account "true"}} + podfactory.custom-default-service-account.enable: "true" +{{- end }} + # This setting enables and disables the container image compliance checks pod.image-check.enable: "{{ .Cluster.ConfigItems.teapot_admission_controller_validate_pod_images }}" diff --git a/cluster/node-pools/master-default/userdata.yaml b/cluster/node-pools/master-default/userdata.yaml index 1cf9fe3af8..f1f5d8a090 100644 --- a/cluster/node-pools/master-default/userdata.yaml +++ b/cluster/node-pools/master-default/userdata.yaml @@ -205,7 +205,8 @@ write_files: limits: memory: {{ .Values.InstanceInfo.MemoryFraction (parseInt64 .Cluster.ConfigItems.apiserver_memory_limit_percent)}} {{- end }} - - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-178 + # - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/production_namespace/teapot/admission-controller:master-178 + - image: 926694233939.dkr.ecr.eu-central-1.amazonaws.com/staging_namespace/teapot/admission-controller:pr-202-4 name: admission-controller lifecycle: preStop: