kubegres icon indicating copy to clipboard operation
kubegres copied to clipboard

Add serviceAccountName to Kubegres CRD

Open paltaa opened this issue 3 years ago • 0 comments

We are working with Vault and CSI provider, so in order to make it possible for Vault to mount the secrets, it is needed to specify the ServiceAccountName in podSpec. I've tried several ways but it is not possible as it always uses the default serviceAccountName.

Example of what is working:

apiVersion: kubegres.reactive-tech.io/v1
kind: Kubegres
metadata:
  name: mypostgres-csi
  namespace: default

spec:
   replicas: 1
   image: postgres:14.1
   database:
      size: 200Mi
   env:
      - name: POSTGRES_PASSWORD
        valueFrom:
            secretKeyRef:
              name: postgres-auth
              key: postgres-password

      - name: POSTGRES_REPLICATION_PASSWORD
        valueFrom:
            secretKeyRef:
              name: postgres-auth
              key: postgres-password
   volume:
    volumeMounts:
    - name: secrets-store-inline
      mountPath: "/mnt/secrets-store"
      readOnly: true
    volumes:
      - name: secrets-store-inline
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "postgres-auth"

What is needed:

apiVersion: kubegres.reactive-tech.io/v1
kind: Kubegres
metadata:
  name: mypostgres-csi
  namespace: default

spec:
   serviceAccountName: kubegres-sa
   replicas: 1
   image: postgres:14.1
   database:
      size: 200Mi
   env:
      - name: POSTGRES_PASSWORD
        valueFrom:
            secretKeyRef:
              name: postgres-auth
              key: postgres-password

      - name: POSTGRES_REPLICATION_PASSWORD
        valueFrom:
            secretKeyRef:
              name: postgres-auth
              key: postgres-password
   volume:
    volumeMounts:
    - name: secrets-store-inline
      mountPath: "/mnt/secrets-store"
      readOnly: true
    volumes:
      - name: secrets-store-inline
        csi:
          driver: secrets-store.csi.k8s.io
          readOnly: true
          volumeAttributes:
            secretProviderClass: "postgres-auth"

So is there a way to achieve this? if not, could it be added to the CRD ?

paltaa avatar Oct 17 '22 20:10 paltaa