-
Notifications
You must be signed in to change notification settings - Fork 107
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove -sa suffix from generated service account #885
Remove -sa suffix from generated service account #885
Conversation
b5bd7f9
to
bfdeb63
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just quick question: Should we open an issue to remove the GetHeritageGeneratedServiceAccountName
section at some point far into the future, where we believe there should be no more service accounts with that suffix?
/lgtm
Yes, I'll open one for v1.0.0. |
/approve |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: HeavyWombat The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Changes
There was a bug in Calico before 3.20.0 where it unconditionally passed
pod.spec.serviceAccountName
as a label value to its WorkloadEndpoint. But label values cannot exceed 63 characters while a longer ServiceAccount name is allowed. Their fix is Use a spec field on WEPs for ServiceAccount name #1422.But, especially in managed Kubernetes environments, the Calico version is not necessarily that new. For example, IKS 1.21 is at 3.19 just slightly below this.
In Shipwright, we already limit the BuildRun length to 63 characters because we use it as label value on the TaskRun (and pod). But, the name of the generated ServiceAccount used to be
${buildRunName}-sa
.I changed the logic to make the name of the ServiceAccount be the BuildRun name. Added code to still delete the one with the
-sa
suffix to not cause dangling SAs.Used that chance to move the removal logic from buildrun.go into serviceaccount.go.
Submitter Checklist
Release Notes