ServiceAccount

Wed, 16 Feb 2022 12:00:00 +0000

If you have seen errors like these when deploying using a serviceAccount

Error: INSTALLATION FAILED: rendered manifests contain a resource that already exists. Unable to continue with install: could not get information about the resource ConfigMap "spinnaker-hellow-pipline" in namespace "spinnaker": configmaps "spinnaker-hellow-pipline" is forbidden: User "system:serviceaccount:jenkins:default" cannot get resource "configmaps" in API group "" in the namespace "spinnaker"

What?
#

A service account provides an identity for processes that run in a Pod.
Every namespace has a default service account
When you create a pod, if you do not specify a service account, it is automatically assigned the default service account in the same namespace.
To use a non-default service account, set the spec.serviceAccountName field of a pod to the name of the service account you wish to use.
The service account has to exist at the time the pod is created, or it will be rejected.
The service account of an already created pod cannot be updated

Default RBAC policies grant scoped permissions to control-plane components, nodes, and controllers, but grant no permissions to service accounts outside the kube-system namespace (beyond discovery permissions given to all authenticated users). — Official documentation

Example
#

apiVersion: v1
kind: ServiceAccount
metadata:
 creationTimestamp: "2021-08-27T07:52:20Z"
 name: default
 namespace: default
 resourceVersion: "XXXX"
 uid: XXXX
secrets:
- name: default-token-vcb75

Let’s add docker-registry secret to the SA. (My secret name is samarthya-docker)

Serviceaccount on Samarthya

ServiceAccount

What? #

Example #

What?
#

Example
#