Repository navigation
WorkerPool can set the ServiceAccount of its worker pods - #2219
Merged
Julian Gutierrez Oschmann (juli4n) merged 2 commits intoOct 7, 2026
Conversation
Worker pods always ran as the namespace's default ServiceAccount. Clusters with an admission policy that denies the default ServiceAccount (for example, OPA Gatekeeper) could not run workers. Add spec.template.serviceAccountName. The controller also owns the deprecated spec.serviceAccount alias. The API server copies the name into the alias and reads the alias back when the name is empty, so without it, removing the field would keep the old ServiceAccount. The field is a pointer with MinLength=1 to satisfy the kube-api-linter optionalfields rule.
2 tasks done
Julian Gutierrez Oschmann (juli4n)
self-requested a review
October 6, 2026 14:27
When the WorkerPool omits serviceAccountName, set "default" instead of an empty name. A non-empty name wins over the deprecated serviceAccount alias, so the controller no longer needs to own the alias.
Danielle Mustillo (danielle-mustillo)
requested a review
from Eitan Yarmush (EItanya)
October 6, 2026 15:44
Danielle Mustillo (danielle-mustillo)
marked this pull request as ready for review
October 6, 2026 15:45
Collaborator
|
It's a bit unfortunate that we need this field as workers should not need a KSA identity, so this is just to make your policy enforcement happy. That being said, I don't see any other simpler option. |
Collaborator
I think the question for me is whether there is a downside to this, and I don't think so. I've heard this requirement come up multiple times, and I think requiring the user to build their own controller for this is overly burdensome. In that light I'm ok with it |
Max Smythe (maxsmythe)
added
area/identity
kind/bug
Julian Gutierrez Oschmann (juli4n)
approved these changes
Oct 7, 2026
2 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A WorkerPool now has
spec.template.serviceAccountName. The worker pods run as that ServiceAccount. When the field is omitted, the pods use the namespace'sdefaultServiceAccount, as before.Some clusters have an admission policy (for example, OPA Gatekeeper) that rejects pods that use the
defaultServiceAccount. These clusters could not run workers.Notes for review:
*stringwithMinLength=1, because kube-api-linter requires new optional fields to be pointers. An explicit empty string is rejected.Testing
Unit and envtest suites (126 packages), apitool, and the verify scripts. Not run: proto-fmt (no local clang-format).
Local kind e2e, envoy dataplane, gVisor: pass, including identity.
Tests pass
Appropriate changes to documentation are included in the PR (
docs/api-guide.md)