declaratively mount a service account secret in OpenShift

Question

I am using helm charts to deploy some webhook handlers. The handlers need to connect to the cluster they are running on to deploy the configuration within it. It works but one step is tricky to move into the helm chart. When the chart makes the service account it gives it a randomly named secret:

$ oc describe sa sa-build-webhook-realworld
Name:                sa-build-webhook-realworld
Namespace:           your-eng2
Labels:              app=sa-build-webhook-realworld
Annotations:         
Image pull secrets:  sa-build-webhook-realworld-dockercfg-4qz9g
Mountable secrets:   sa-build-webhook-realworld-token-bqtnw
                     sa-build-webhook-realworld-dockercfg-4qz9g
Tokens:              sa-build-webhook-realworld-token-bqtnw
                     sa-build-webhook-realworld-token-k7lq8
Events:              <none>

I can grab that and set it on the deployment config with:

#https://codereview.stackexchange.com/a/212095/75693
SECRET_NAME=$(
    oc describe sa sa-tag-realworld |
    awk -F': *' '
        $2  { KEY=$1 ; VALUE=$2;  }
        !$2 {          VALUE=$1; }
        KEY=="Mountable secrets" && VALUE !~ /docker/ { print VALUE }
    '
)
oc set volume dc/webhook-realworld \
  --add --name=sa-secret-volume \
  --mount-path=/sa-secret-volume \
  --secret-name=$SECRET_NAME

I am trying to see if there is a way to do this declaratively in the chart yaml that creates the dc and sa at the same time which is here.

Is there a way to reference the generated service account secret from the deployment config in the chart?

Or should I be trying to get helm/helmfile to do the command-line lookup as part of its work?

You can use ServiceAccounts to run your pods, that may be something worth exploring: kubernetes.io/docs/tasks/configure-pod-container/… — Will Gordon
great kubectl shows serviceAccountName: default so I will try putting it into the chart and see if then the automounted secret works as per that doc. i will let you know. — simbo1905
yep. kubectl gives the correct service account and its is mounted into the default location and its want I was mounting myself as confirmed by diff diff /var/run/secrets/kubernetes.io/serviceaccount/token /sa-secret-volume/token — simbo1905
@WillGordon if you would like to post an answer i would accept it. cheers! — simbo1905

Will Gordon Will Gordon · Accepted Answer · 2019-01-28T22:43:41

Inside of your .spec.template.spec, you can specify a serviceAccountName to ensure that your pod runs and authenticates as the desired ServiceAccount. Source: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

Example

kind: DeploymentConfig
apiVersion: apps.openshift.io/v1
metadata:
  name: deployment
spec:
    metadata:
      name: deployment-pod
    spec:
      serviceAccountName: sa-build-webhook-realworld
  ...

declaratively mount a service account secret in OpenShift

1 Answers