Backend: Update the deployment to use the image pull secret through service account
MR: Configure workspace service account to use imag... (!170973 - merged)
Description
As per the plan in Provide support to use images from private cont... (&14664 - closed) , update the deployment to use the image pull secret through service account.
During reconciliation, create a service account add it to the desired config here
apiVersion: v1
kind: ServiceAccount
metadata:
name: <workspace.name>
namespace: <workspace.namespace>
automountServiceAccountToken: false
imagePullSecrets:
- name: name1
- name: name2
The imagePullSecrets
are the associated agent's image_pull_secrets - (only the name
field in them).
automountServiceAccountToken
is set to false
as a safety measure because we don't want anyone inside the workspace interacting with Kubernetes.
Once the service account is created, we need to configure the Deployment to use it. Update the deployment in the devfile_parser with the name of the service account in deployment.spec.template.spec.serviceAccountName
.
Acceptance Criteria
-
A service account is sent to the agent always for a workspace on full or partial -
The service account is generated with image pull secrets to the associated agent's image_pull_secret's name fields. -
The service account is generated with automountServiceAccountToken
is set tofalse
. -
Deployment is modified to use the above generated service account. -
Feature as described in Provide support to use images from private cont... (&14664 - closed) works E2E. -
Update integration specs as well if required