search

openkruise / kruise

Automated management of large-scale applications on Kubernetes (incubating project under CNCF)
https://openkruise.io
Other
4.68k stars 770 forks source link

[feature request] sidecarset support inject serviceaccount #1747

Open magicsong opened 2 months ago

magicsong commented 2 months ago

Use Case: For example, if a sidecar container needs to access Kubernetes resources such as ConfigMaps, Secrets, or interact with the API server for other reasons, it would require a ServiceAccount with appropriate permissions. Injecting the ServiceAccount directly through the SidecarSet simplifies this process and makes it more manageable.

Proposed Implementation:

Extend the SidecarSet specification to include an optional serviceAccountName field. When applying the SidecarSet to a Pod, inject the specified ServiceAccount into the sidecar container configuration.

By the way, there is no reason to ask user's pod to inject a service account which not used by their app

furykerry commented 2 months ago

it will be very limited in usage even if sidecarset support service account injection. consider the case that the pod already has service account configured, actually most pod will use the default servicer account. Shall we replace the service account with the one in sidecarset ?

magicsong commented 2 months ago

it will be very limited in usage even if sidecarset support service account injection. consider the case that the pod already has service account configured, actually most pod will use the default servicer account. Shall we replace the service account with the one in sidecarset ?

The default service account is often just a default value that users are not aware of. The scenario I'm referring to is replacing this default. If the user is already using a service account, my application will provide documentation that requires updating its permissions rather than replacing the user's service account.

furykerry commented 1 month ago

i think sa injection can be made an optional feature, but it should be only limited to replace default service account. And if multiple sidecarset that manage the same pod with service account injection is configured, which sa should be injected ? if you have any idea, plz submit a KEP, and we can discuss the detail with the kep context

magicsong commented 1 month ago

i think sa injection can be made an optional feature, but it should be only limited to replace default service account. And if multiple sidecarset that manage the same pod with service account injection is configured, which sa should be injected ? if you have any idea, plz submit a KEP, and we can discuss the detail with the kep context

eagerly willing to contribute to this kep