Skip to content

combo of "environment" and KUBERNETES_SERVICE_ACCOUNT_OVERWRITE does not work

Summary

  variables:
    KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: argocd-application-controller

Is not being honored when the "environment" stanza used on the job definition. It is honored just fine without the "environment" stanza.

Steps to reproduce

argo-cleanup:
  environment: dev
  stage: argo-cleanup
  variables:
    KUBERNETES_NAMESPACE_OVERWRITE: argocd
    KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: argocd-application-controller
  script:
    - echo "some script that performs kubectl apply -n argocd and needs argocd-application-controller sa"
  tags:
    - k8s   

Actual behavior

I am using only the K8S cluster that gitlab is installed on. The actual SA that runs the job is "system:serviceaccount:ocp-3-11-16-dev:ocp-3-11-16-dev-service-account" seems the default one: My GitLab project is named "ocp-3-11" project id "16" and env is "dev") But not argocd-application-controller because I receive :

forbidden: User "system:serviceaccount:ocp-3-11-16-dev:ocp-3-11-16-dev-service-account" cannot get resource

Expected behavior

the jobs runs with the SA that I specified in the override variable

Relevant logs and/or screenshots

job log
Add the job log

Environment description

config.toml contents
Add your configuration here

Used GitLab Runner version

Possible fixes