Skip to content

AWS ServiceAccountToken not accessible. #871

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

AWS ServiceAccountToken not accessible. #871

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fb512b8
Fix for AWS ServiceAccount (see https://github.com/kubernetes-sigs/ex…
tektite-io Sep 15, 2021
fb061d5
Merge pull request #1 from tektite-io/aws-service-account
tektite-io Sep 15, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions snyk-monitor/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,10 @@ spec:
{{- toYaml . | nindent 8 }}
{{- end }}
spec:
{{- if ne .Values.securityContext.fsGroup "" }}
securityContext:
fsGroup: 65534
{{- end }}
affinity:
nodeAffinity:
requiredDuringSchedulingIgnoredDuringExecution:
Expand Down Expand Up @@ -172,6 +176,13 @@ spec:
name: {{ .Values.defaultWorkloadPoliciesMap }}
{{- end }}
optional: true
{{- if .Values.volumes.projected.serviceAccountToken }}
- name: token-vol
projected:
sources:
- serviceAccountToken:
path: token
{{- end }}
Comment on lines +179 to +185
Copy link
Contributor

@ivanstanev ivanstanev Sep 16, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @tektite-io I was wondering if this volume also needs to be mounted with a volumeMount? The example in the docs both declares the volume and a volumeMount - https://kubernetes.io/docs/concepts/storage/volumes/#example-configuration-secret-downwardapi-configmap
And if we have to mount this volume, where should it go?

Also, it looks like token expires by default after 1 hour according to the docs. How should we handle this?

- name: registries-conf
configMap:
name: {{ .Values.registriesConfConfigMap }}
Expand Down
15 changes: 15 additions & 0 deletions snyk-monitor/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,3 +108,18 @@ psp:

# Override the excluded namespaces
excludedNamespaces:

# Allow specifying a fsGroup in
# spec:
# template:
# spec:
# securityContext:
# fsGroup: 65534 <-- here
securityContext:
fsGroup: ""

# A projected volume maps several existing volume sources into the same directory.
# https://kubernetes.io/docs/concepts/storage/volumes/#projected
volumes:
projected:
serviceAccountToken: false