search

allegroai / clearml-helm-charts

Helm chart repository for the new unified way to deploy ClearML on Kubernetes. ClearML - Auto-Magical CI/CD to streamline your AI workload. Experiment Management, Data Management, Pipeline, Orchestration, Scheduling & Serving in one MLOps/LLMOps solution
https://clear.ml/docs
36 stars 50 forks source link

[clearml] Allow annotations for service account for apiserver #330

Open aaj-synth opened 1 week ago

aaj-synth commented 1 week ago

Is your feature request related to a problem ?

As per storage documentation, we want to configure clearml server to write artifacts to S3 bucket on AWS, but currently that is not possible.

Describe the solution you'd like.

A solution would require apiserver pod to either have custom service account provided by the user which would allow the pod to access the S3 bucket, or allow the service account template to configure additional annotations to allow pod to access the S3 bucket. Helm chart values file would look something like this:

apiserver:
  existingServiceAccountName: ""
  serviceAccountName: ""
  serviceAccountAnnotations: {}

Describe alternatives you've considered.

Currently the way to make it work is to create a role in AWS which has the necessary permissions, and attach the annotations on the serviceAccount to allow it to access S3 bucket. This is far from ideal and creates lots of duplicated code and tech-debt

Additional context.

I am currently using helm chart version 7.11.4

aaj-synth commented 1 week ago

@filippo-clearml any updates on this one?

filippo-clearml commented 6 days ago

@aaj-synth You should already be able to edit serviceAccountName to use an existing custom service account, is this working for you? Anyway being able to add custom annotations and labels is a good idea, we'll work on that :)

aaj-synth commented 6 days ago

Yes, that edit part is working but takes away a lot of deployment power, as someone has to jump in and do the trick for the system to work, and ofcourse have to restart the apiserver so that the pod picks up the correct role from the serviceaccount.

Indeed that would be great to have, and another thing which would be really nice to have is to allow user to bring in their own serviceaccount.