From 90848e48db9554720047b2afd5760812f17bff13 Mon Sep 17 00:00:00 2001
From: Tom Augspurger <tom.w.augspurger@gmail.com>
Date: Tue, 9 Jun 2020 14:33:47 -0500
Subject: [PATCH] Use pangeo serviceAccount everywhere

This makes us use the `pangeo` Kubernetes ServiceAccount on

* singleuser pods
* scheduler pods
* worker pods

Previously, we only used it for worker pods, except for icesat which
used it for singleuser & worker.

This is in preparation for granting read / write access to a storage
bucket to the `pangeo` service account on the cloud backends.
---
 deployments/icesat2/config/common.yaml | 1 -
 pangeo-deploy/values.yaml              | 4 ++++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/deployments/icesat2/config/common.yaml b/deployments/icesat2/config/common.yaml
index b9dec6e3..c2c760e4 100644
--- a/deployments/icesat2/config/common.yaml
+++ b/deployments/icesat2/config/common.yaml
@@ -37,7 +37,6 @@ pangeo:
             environment: {'NVIDIA_DRIVER_CAPABILITIES': 'compute,utility'}
             tolerations: [{'key': 'nvidia.com/gpu','operator': 'Equal','value': 'present','effect': 'NoSchedule'}]
             extra_resource_limits: {"nvidia.com/gpu": "1"}
-      serviceAccountName: pangeo
       startTimeout: 600
       initContainers:
         - name: change-volume-mount-permissions
diff --git a/pangeo-deploy/values.yaml b/pangeo-deploy/values.yaml
index b538581a..62606943 100644
--- a/pangeo-deploy/values.yaml
+++ b/pangeo-deploy/values.yaml
@@ -30,6 +30,7 @@ pangeo:
         # The default worker image matches the singleuser image.
         DASK_GATEWAY__CLUSTER__OPTIONS__IMAGE: '{JUPYTER_IMAGE_SPEC}'
         DASK_GATEWAY__AUTH__TYPE: 'jupyterhub'
+      serviceAccountName: pangeo
 
     prePuller:
       hook:
@@ -45,6 +46,9 @@ pangeo:
   dask-gateway:
     gateway:
       backend:
+        scheduler:
+          extraPodConfig:
+            serviceAccountName: pangeo
         worker:
           extraContainerConfig:
             securityContext: