Skip to content

Backend: Update the deployment to use the image pull secret through service account

MR: Configure workspace service account to use imag... (!170973 - merged)

Description

As per the plan in Provide support to use images from private cont... (&14664 - closed) , update the deployment to use the image pull secret through service account.

During reconciliation, create a service account add it to the desired config here

apiVersion: v1
kind: ServiceAccount
metadata:
  name: <workspace.name>
  namespace: <workspace.namespace>
automountServiceAccountToken: false
imagePullSecrets:
  - name: name1
  - name: name2

The imagePullSecrets are the associated agent's image_pull_secrets - (only the name field in them).

automountServiceAccountToken is set to false as a safety measure because we don't want anyone inside the workspace interacting with Kubernetes.

Once the service account is created, we need to configure the Deployment to use it. Update the deployment in the devfile_parser with the name of the service account in deployment.spec.template.spec.serviceAccountName.

Acceptance Criteria

  • A service account is sent to the agent always for a workspace on full or partial
  • The service account is generated with image pull secrets to the associated agent's image_pull_secret's name fields.
  • The service account is generated with automountServiceAccountToken is set to false.
  • Deployment is modified to use the above generated service account.
  • Feature as described in Provide support to use images from private cont... (&14664 - closed) works E2E.
  • Update integration specs as well if required
Edited by Safwan Ahmed