search

Azure / draft-classic

A tool for developers to create cloud-native applications on Kubernetes.
https://draft.sh
MIT License
3.92k stars 395 forks source link

Use Tiller/Helm ServiceAccount (RBAC) #404

Closed jalberto closed 6 years ago

jalberto commented 7 years ago

Currently is not possible to define serviceAccount for draft, so it will use default one in whatever namespace command is run. This cause troubles when running draft as part of CI/CD.

$ draft init --client-only
Creating /root/.draft 
Creating /root/.draft/plugins 
Creating /root/.draft/packs 
Creating pack gradle...
Creating pack python...
Creating pack go...
Creating pack php...
Creating pack ruby...
Creating pack javascript...
Creating pack java...
Creating pack csharp...
$DRAFT_HOME has been configured at /root/.draft.
Skipped installing Draft's server side component in Kubernetes due to 'client-only' flag having been set
Happy Sailing!
$ draft up
Error: User "system:serviceaccount:testing:default" cannot list pods in the namespace "kube-system". (get pods)
ERROR: Job failed: error executing remote command: command terminated with non-zero exit code: Error executing in Docker Container: 1

Even out of CI/CD system draft may need to deploy to different name-spaces (like Helm)

I edited draftd deployment and added:

serviceAccount: tiller
serviceAccountName: tiller

but got same error

Is there any workaround?

bacongobbler commented 7 years ago

Hey! You should be able to follow the steps as mentioned in https://github.com/Azure/draft/issues/358#issuecomment-336495386. Draft is deployed as a bunch of kubernetes resources so you can hack around this by deploying your own custom resources.

jalberto commented 7 years ago

@bacongobbler I already tried to add serviceAccount: tiller to draftd deployment in kube-system (it saves and apply without complains) but I get same error.

Can you point me where do you suggest I modify this?

Thanks

jalberto commented 7 years ago

To be clear, my goal is to be able to use draft for CD, so running 'draft' cli in namespaceA must be able to deploy/upgrade app in any other namespace (like helm does)

bacongobbler commented 7 years ago

I don't have any suggestions, but if you get it working then please let us know and we can document it. :)

jalberto commented 7 years ago

I will!

This is my only blocker to use draft in my CI/CD workflow in ACS

@backpackerjmk is this not a common use case for draft?

bacongobbler commented 7 years ago

not necessarily. It's more designed as a dev tool to hack on your app. It's better to use helm for your CI/CD pipeline, which is what Draft uses under the covers. See the linked design doc for more background. :)

jalberto commented 6 years ago

@bacongobbler then Draft readme must be edited to clear this confusion, I quote:

"Once the developer is happy with changes made via Draft, they commit and push to version control, after which a continuous integration (CI) system takes over. Draft builds upon Kubernetes Helm and the Kubernetes Chart format, making it easy to construct CI pipelines from Draft-enabled applications."

squillace commented 6 years ago

Ah, yes. That sentences was intended to say that once you're happy with the app on which you're working, you'd push that code to git and a webhook would kick of a CI/CD build/testing/staging process -- not draft itself.

Does that make sense? Ultimately, the result of draft usage is code+dockerfile+chart, which is the full complement of artifacts necessary to build, contain, stash images, and deploy images with service configuration.

jalberto commented 6 years ago

for me the wording means draft can be used for the whole cycle

On Sat, 4 Nov 2017 at 02:43 Ralph Squillace notifications@github.com wrote:

Ah, yes. That sentences was intended to say that once you're happy with the app on which you're working, you'd push that code to git and a webhook would kick of a CI/CD build/testing/staging process -- not draft itself.

Does that make sense? Ultimately, the result of draft usage is code+dockerfile+chart, which is the full complement of artifacts necessary to build, contain, stash images, and deploy images with service configuration.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/Azure/draft/issues/404#issuecomment-341863120, or mute the thread https://github.com/notifications/unsubscribe-auth/AAGGV8k6EiAKcPmtfPnrXRrdKzDiDORXks5sy8EqgaJpZM4P99jz .