You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Oct 14, 2024. It is now read-only.
Is your feature request related to a problem? Please describe.
At the moment, we cannot set the serviceAccount for runtime-scan-jobs using Helm. Moreover, it always uses the default serviceAccount. This limitation doesn't allow us to use existing serviceAccounts to provide access to artifactRegistry using Workload Identity instead of keeping google service account in kubernetes secret (gcr-sa).
Describe the solution you'd like
I would like to have the ability to set the serviceAccount for runtime-scan-jobs using a Helm variable .Values.kubeclarity-runtime-scan.serviceAccount.name.
Here is an example of how it could be implemented in scanner-template-configmap.yaml:
{{- if index .Values "kubeclarity-runtime-scan" "serviceAccount" "name"}}
serviceAccount: {{ index .Values "kubeclarity-runtime-scan" "serviceAccount" "name" | quote} }
{{- end}}
Describe alternatives you've considered
We can modify the kubeclarity-kubeclarity-scanner-template ConfigMap by hand, but this approach is inconvenient and error-prone. We also can
Additional context
By adding this feature, users would be able to utilize existing serviceAccounts, which is particularly useful for providing necessary permissions, such as access to artifactRegistry in GCP.
The text was updated successfully, but these errors were encountered:
ramizpolic
changed the title
Allow to define non-default serviceAccount for the runtime-scan-job
[kubeclarity] Allow to define non-default serviceAccount for the runtime-scan-job
Aug 8, 2024
ramizpolic
changed the title
[kubeclarity] Allow to define non-default serviceAccount for the runtime-scan-job
Allow to define non-default serviceAccount for the runtime-scan-job
Aug 8, 2024
Is your feature request related to a problem? Please describe.
At the moment, we cannot set the
serviceAccount
forruntime-scan-jobs
using Helm. Moreover, it always uses thedefault
serviceAccount. This limitation doesn't allow us to use existingserviceAccount
s to provide access toartifactRegistry
using Workload Identity instead of keeping google service account in kubernetes secret (gcr-sa
).Describe the solution you'd like
I would like to have the ability to set the
serviceAccount
forruntime-scan-jobs
using a Helm variable.Values.kubeclarity-runtime-scan.serviceAccount.name
.Here is an example of how it could be implemented in
scanner-template-configmap.yaml
:Describe alternatives you've considered
We can modify the
kubeclarity-kubeclarity-scanner-template
ConfigMap by hand, but this approach is inconvenient and error-prone. We also canAdditional context
By adding this feature, users would be able to utilize existing
serviceAccount
s, which is particularly useful for providing necessary permissions, such as access toartifactRegistry
in GCP.The text was updated successfully, but these errors were encountered: