control-service: configurable builder job service account #791
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Currently, builder job is based on Kaniko and requires root privileges. In some cases Pod Security Policy can be configured based on namespace and service account. However, Control Service does not provide the ability to set a service account to the Builder Job. This change aims to provide an ability to set a service account through the Helm Chart. spec.template.spec.serviceAccountName: "account_name" Testing done: unit tests and helm template Signed-off-by: Miroslav Ivanov [email protected]
doks5
approved these changes
Apr 7, 2022
projects/control-service/projects/helm_charts/pipelines-control-service/values.yaml
Show resolved
Hide resolved
mivanov1988
deleted the
topic/miroslavi/configurable-job-builder-service-account
branch
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 7, 2022
- Can be instantiated from code rather than via the VDK CLI - Can be run without needing any data job files - Gives access to an instantiated job_input object - WIP Signed-off-by: David Laing <[email protected]> Co-authored-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 11, 2022
- Implemented as a contextmanager to reduce API surface area Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 12, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 14, 2022
- Also pass the initialised JobContext (which contains JobContext.job_input) Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 27, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 27, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 27, 2022
... rather than a JobContext so as to minimize API surface area Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 28, 2022
- IStandalongDataJob - StandaloneDataJobFactory.create() Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 28, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
Apr 28, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
pushed a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
May 6, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
pushed a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
May 8, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
pushed a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
May 9, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
pushed a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
May 10, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
pushed a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
May 10, 2022
Signed-off-by: David Laing <[email protected]>
mrdavidlaing
added a commit
to mrdavidlaing/versatile-data-kit
that referenced
this pull request
May 11, 2022
- Instantiate and execute plugin lifecycle from code rather than via the VDK CLI
- Gives access to an instantiated job_input object
- Can be run without needing any data job files
- Implemented as a contextmanager to reduce API surface area
- Triggers all plugin hooks except:
* CoreHookSpecs.vdk_command_line
Sample usage:
with StandaloneDataJobFactory.create(datajob_directory) as job_input:
#... use job_input object to interact with SuperCollider
antoniivanov
pushed a commit
that referenced
this pull request
May 11, 2022
- Instantiate and execute plugin lifecycle from code rather than via the VDK CLI
- Gives access to an instantiated job_input object
- Can be run without needing any data job files
- Implemented as a contextmanager to reduce API surface area
- Triggers all plugin hooks except:
* CoreHookSpecs.vdk_command_line
Sample usage:
with StandaloneDataJobFactory.create(datajob_directory) as job_input:
#... use job_input object to interact with SuperCollider
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently, the builder job is based on Kaniko and requires root privileges.
In some cases, Pod Security Policy can be configured based on namespace and service account.
However, Control Service does not provide the ability to set a service account to the Builder Job.
This change aims to provide an ability to set a service account through the Helm Chart.
spec.template.spec.serviceAccountName: "account_name"
Testing done: unit tests and helm template
Signed-off-by: Miroslav Ivanov [email protected]