fix: Make serviceAccount.name and serviceAccount.create work - #418
fix: Make serviceAccount.name and serviceAccount.create work#418lfrancke wants to merge 2 commits into
Conversation
Same fix as hive-operator#742, applied to the two CSI workloads. serviceAccount.name had no effect: the ServiceAccount and both workloads hardcoded <fullname>-serviceaccount, so the value was silently ignored. They now resolve the name through operator.serviceAccountName. With serviceAccount.create=false the helper fell back to "default", giving pods running as the namespace default ServiceAccount without the operator's ClusterRole. It now requires serviceAccount.name, so the chart fails to render instead of installing something that cannot work. Rendered output is unchanged for the default values. _helpers.tpl and serviceaccount.yaml are generated from operator-templating and are ahead of the template until the matching change lands there.
|
One thing is still a bit off, maybe we could also fix this while we're at it: So the pods now run as |
|
Ah yes. I saw this over in Hive as well and wondered if there is a reason for that. "Over there" I documented it assuming I didn't know enough about Kubernetes. But yes: Happy to change it. I would suggest though to not do that in this PR but merge this and secret and then fix it for all of the operators via operator-templating. |
|
What that means is I need to fix the docs for the value schema in Hive but that's not a problem |
|
I created a templating PR with more explanation: stackabletech/operator-templating#637 |
Same fix as stackabletech/hive-operator#742 please read there for details.
Fixing this here before I move the rest to operator templating because when we fix the
_helpers.tplandserviceaccount.yamlin templating they will be merged here and suddenly potentially make the whole create and name stuff actually work but those non-templated two files will still refer to the old SA which now doesn't exist and the pod won't start.In other words: Currently it's ignored (broken). If we don't fix it here first pods might not start. So we fix it here first, then do templating.
secret-operatorhas the same two workloads and needs the same fix.