🐛 feat(rbac): use real ServiceAccount instead of default #519

cwrau · 2024-05-07T14:55:23Z

Closes #518

k8s-ci-robot · 2024-05-07T14:55:32Z

Welcome @cwrau!

It looks like this is your first PR to kubernetes-sigs/cluster-api-operator 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api-operator has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-05-07T14:55:32Z

Hi @cwrau. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

netlify · 2024-05-07T14:55:39Z

✅ Deploy Preview for kubernetes-sigs-cluster-api-operator ready!

Name	Link
🔨 Latest commit	`a4db00b`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-sigs-cluster-api-operator/deploys/6643195988c0dd00082858fc
😎 Deploy Preview	https://deploy-preview-519--kubernetes-sigs-cluster-api-operator.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

cwrau · 2024-05-07T15:04:30Z

I don't know how I would make the serviceAccountName in the deployment.yaml "generated" like the name in the service_account.yaml, so I just hardcoded it to the value that got generated?

Fedosin

/ok-to-test

cwrau · 2024-06-11T08:58:18Z

Heyho, is there something I can do to help this get merged? 😊

alexander-demicev

/approve

k8s-ci-robot · 2024-06-21T09:08:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alexander-demicev

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [alexander-demicev]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

furkatgofurov7 · 2024-06-24T08:36:11Z

config/manager/manager.yaml

@@ -15,6 +15,8 @@ spec:
      labels:
        control-plane: controller-manager
    spec:
+      serviceAccountName: manager
+      automountServiceAccountToken: true


Q: is this set to false and best practice, when the default SA is used?

If I understand the question correctly, yes, it's best-practice to set this to false when not using a custom serviceAccount to prevent the accidental usage of the default serviceAccount

In general it's best-practice to not use the default serviceAccount anyways

furkatgofurov7 · 2024-06-24T08:56:46Z

/lgtm

k8s-ci-robot · 2024-06-24T08:56:53Z

LGTM label has been added.

Git tree hash: f5f14b2b0c0f7450c4f4b41b5755d685ac50892c

cwrau · 2024-07-04T07:25:26Z

Heyho, is there a timeline when this will be released?

furkatgofurov7 · 2024-07-05T07:35:15Z

@cwrau since this is breaking change and can't be released with patch release (and in fact it was not backported). I just checked the changelog since last minor v0.11 release and it is quite small for cutting a minor release. How urgent this change for you, can we give some more time for new minor release before cutting it?

cc @Fedosin @alexander-demicev @Danil-Grigorev

cwrau · 2024-07-08T09:02:45Z

@cwrau since this is breaking change

Why is this a breaking change? 🤔
Everything just worked after this change for me

and can't be released with patch release (and in fact it was not backported). I just checked the changelog since last minor v0.11 release

But if we assume that this is a breaking change, why would you ever want to release this as a minor version instead of a breaking one?! 😮

and it is quite small for cutting a minor release. How urgent this change for you, can we give some more time for new minor release before cutting it?

cc @Fedosin @alexander-demicev @Danil-Grigorev

Is it a problem to release frequently with small changes? 🤔

But it's not urgent right now, we're using flux pathes to rectify this in the meantime

furkatgofurov7 · 2024-07-08T09:09:10Z

Why is this a breaking change? 🤔
Everything just worked after this change for me

That is because the PR was labelled with ⚠️:

cluster-api-operator/.github/PULL_REQUEST_TEMPLATE.md

Line 2 in fbe3b5a

    
           <!-- the icon will be either ⚠️ (:warning:, major or breaking changes), ✨ (:sparkles:, feature additions), 🐛 (:bug:, patch and bugfixes), 📖 (:book:, documentation or proposals), or 🌱 (:seedling:, minor or other) -->

so that was my assumption

But if we assume that this is a breaking change, why would you ever want to release this as a minor version instead of a breaking one?!

Breaking changes are usually accepted and released as part of the minor releases and not the patch. I am not sure what do you mean as "breaking one" in this context.

cwrau · 2024-07-08T09:26:40Z

Why is this a breaking change? 🤔
Everything just worked after this change for me

That is because the PR was labelled with ⚠️:

cluster-api-operator/.github/PULL_REQUEST_TEMPLATE.md

Line 2 in fbe3b5a



so that was my assumption

Ah, @Fedosin changed the title at some point, maybe he can chime in why?

But if we assume that this is a breaking change, why would you ever want to release this as a minor version instead of a breaking one?!

Breaking changes are usually accepted and released as part of the minor releases and not the patch. I am not sure what do you mean as "breaking one" in this context.

Oh, sorry, typo 😅
I meant major release

So this project is not following semver? 😕

furkatgofurov7 · 2024-07-08T09:45:45Z

So this project is not following semver? 😕

Well, it does follow semver in a way similar to how CAPI does https://cluster-api.sigs.k8s.io/contributing?highlight=release#breaking-changes, but in semVer world breaking changes should land in major release, that I agree.

Also, by looking at this PR again, IMO it is not a breaking change but rather a bug fix considering what it tries to solve

k8s-ci-robot requested review from damdo and neolit123 May 7, 2024 14:55

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels May 7, 2024

cwrau force-pushed the feat/use-real-serviceaccount branch from 88c8e7d to 168724c Compare May 7, 2024 14:55

k8s-ci-robot added do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 7, 2024

cwrau force-pushed the feat/use-real-serviceaccount branch from 168724c to 7b21533 Compare May 7, 2024 14:58

Fedosin changed the title ~~feat(rbac): use real ServiceAccount instead of default~~ ⚠️ feat(rbac): use real ServiceAccount instead of default May 8, 2024

Fedosin reviewed May 8, 2024

View reviewed changes

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 8, 2024

cwrau force-pushed the feat/use-real-serviceaccount branch from 7b21533 to 8289cd2 Compare May 14, 2024 07:54

feat(rbac): use real ServiceAccount instead of default

a4db00b

cwrau force-pushed the feat/use-real-serviceaccount branch from 8289cd2 to a4db00b Compare May 14, 2024 07:57

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label May 14, 2024

alexander-demicev approved these changes Jun 21, 2024

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 21, 2024

furkatgofurov7 reviewed Jun 24, 2024

View reviewed changes

k8s-ci-robot assigned furkatgofurov7 Jun 24, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 24, 2024

k8s-ci-robot merged commit 628476c into kubernetes-sigs:main Jun 24, 2024
14 checks passed

cwrau changed the title ~~⚠️ feat(rbac): use real ServiceAccount instead of default~~ 🐛 feat(rbac): use real ServiceAccount instead of default Jul 9, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 feat(rbac): use real ServiceAccount instead of default #519

🐛 feat(rbac): use real ServiceAccount instead of default #519

cwrau commented May 7, 2024 •

edited

Loading

k8s-ci-robot commented May 7, 2024

k8s-ci-robot commented May 7, 2024

netlify bot commented May 7, 2024 •

edited

Loading

cwrau commented May 7, 2024

Fedosin left a comment

cwrau commented Jun 11, 2024

alexander-demicev left a comment

k8s-ci-robot commented Jun 21, 2024

furkatgofurov7 Jun 24, 2024

cwrau Jun 24, 2024

furkatgofurov7 commented Jun 24, 2024

k8s-ci-robot commented Jun 24, 2024

cwrau commented Jul 4, 2024

furkatgofurov7 commented Jul 5, 2024 •

edited

Loading

cwrau commented Jul 8, 2024

furkatgofurov7 commented Jul 8, 2024 •

edited

Loading

cwrau commented Jul 8, 2024

furkatgofurov7 commented Jul 8, 2024

🐛 feat(rbac): use real ServiceAccount instead of default #519

🐛 feat(rbac): use real ServiceAccount instead of default #519

Conversation

cwrau commented May 7, 2024 • edited Loading

k8s-ci-robot commented May 7, 2024

k8s-ci-robot commented May 7, 2024

netlify bot commented May 7, 2024 • edited Loading

✅ Deploy Preview for kubernetes-sigs-cluster-api-operator ready!

cwrau commented May 7, 2024

Fedosin left a comment

Choose a reason for hiding this comment

cwrau commented Jun 11, 2024

alexander-demicev left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jun 21, 2024

furkatgofurov7 Jun 24, 2024

Choose a reason for hiding this comment

cwrau Jun 24, 2024

Choose a reason for hiding this comment

furkatgofurov7 commented Jun 24, 2024

k8s-ci-robot commented Jun 24, 2024

cwrau commented Jul 4, 2024

furkatgofurov7 commented Jul 5, 2024 • edited Loading

cwrau commented Jul 8, 2024

furkatgofurov7 commented Jul 8, 2024 • edited Loading

cwrau commented Jul 8, 2024

furkatgofurov7 commented Jul 8, 2024

cwrau commented May 7, 2024 •

edited

Loading

netlify bot commented May 7, 2024 •

edited

Loading

furkatgofurov7 commented Jul 5, 2024 •

edited

Loading

furkatgofurov7 commented Jul 8, 2024 •

edited

Loading