Always use dedicated service account in device-plugin helm chart#1372
Conversation
cdesiniotis
requested review from
ArangoGutierrez,
elezar,
klueska and
tariq1890
| {{- if not .Values.mps.enableHostPID }} | ||
| shareProcessNamespace: true | ||
| {{- end }} | ||
| {{- end }} |
There was a problem hiding this comment.
Question: Was this a bug? Were we only adding shareProcessNamespace if we ALSO had a config map?
There was a problem hiding this comment.
I think shareProcessName was a slip anyways. Looks good now.
elezar
left a comment
elezar
left a comment
There was a problem hiding this comment.
Just a question regarding the HOST PID setting for MPS. (Fixing that may justify a separate commit for the changelogs).
|
/cherry-pick release-0.18 |
elezar
force-pushed
the
use-dedicated-service-account
branch
from
e4e9a5d to
d30d159
Compare
|
/ok to test d30d159 |
|
This PR is stale because it has been open 90 days with no activity. This PR will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label. |
github-actions
Bot
added
the
lifecycle/stale
| {{- if not .Values.mps.enableHostPID }} | ||
| shareProcessNamespace: true | ||
| {{- end }} | ||
| {{- end }} |
There was a problem hiding this comment.
I think shareProcessName was a slip anyways. Looks good now.
|
@cdesiniotis This is ready to go. Rebase and merge? |
Signed-off-by: Christopher Desiniotis <cdesiniotis@nvidia.com>
cdesiniotis
force-pushed
the
use-dedicated-service-account
branch
from
d30d159 to
81a0e5e
Compare
|
/ok to test 81a0e5e |
|
/cherry-pick release-0.19 |
|
🤖 Backport PR created for |
|
🤖 Backport PR created for |
5 participants
Before this change, installing the helm chart with default values would lead to the
defaultservice account being used. Using thedefaultservice account is generally discouraged as it is a shared service account that gets used by all pods in the same namespace that don't specify one. If thedefaultservice account was compromised in some way, e.g. given more privileges, then our device-plugin would also gain those privileges and we would not be adhering to the principle of least privilege.This PR updates our helm chart so that a dedicated service account is always created and used.