service account deploy

[fiedlerNr9]

No description provided.

[Copilot]

Pull request overview

This PR adds support for specifying a Kubernetes service account during flyte deploy, threading it through deployment planning into the SerializationContext so task serialization can set security_context.run_as.k8s_service_account.

Changes:

• Add service_account plumbing from CLI (--service-account) through flyte.deploy(..., service_account=...) into SerializationContext.
• Introduce merge_security_context() to inject a service account into the serialized Flyte task security context while preserving task-level secret mounts.
• Add/extend tests to validate service account propagation and security context merging behavior.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
tests/flyte/test_deploy.py	Adds a deploy-level test around passing service account through the deploy pipeline.
tests/flyte/internal/runtime/test_task_serde.py	Adds unit tests for merging security context and ensuring serialized tasks include the service account.
src/flyte/models.py	Extends SerializationContext with an optional service_account field.
src/flyte/cli/_deploy.py	Adds --service-account CLI option and passes it to flyte.deploy().
src/flyte/_internal/runtime/task_serde.py	Adds merge_security_context() and uses it during task serialization.
src/flyte/_deploy.py	Extends DeploymentPlan and deploy()/apply() to carry service account into serialization.

Comments suppressed due to low confidence (1)

src/flyte/_deploy.py:596

• The deploy() docstring doesn’t document the newly added service_account parameter, even though it changes serialization behavior (injected into task security context). Please add a :param service_account: entry describing what it controls and how it interacts with task-level secrets/security context.

    """
    Deploy the given environment or list of environments.
    :param envs: Environment or list of environments to deploy.
    :param dryrun: dryrun mode, if True, the deployment will not be applied to the control plane.
    :param version: version of the deployment, if None, the version will be computed from the code bundle.
    TODO: Support for interactive_mode
    :param interactive_mode: Optional, can be forced to True or False.
       If not provided, it will be set based on the current environment. For example Jupyter notebooks are considered
         interactive mode, while scripts are not. This is used to determine how the code bundle is created.
    :param copy_style: Copy style to use when running the task

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This test name says it verifies the service account is passed into the SerializationContext, but the assertion only checks that the DeploymentPlan passed to apply() has service_account set. Either rename the test to reflect what it asserts, or extend the test to validate the SerializationContext actually receives/uses the value (e.g., by not mocking apply and instead asserting on the constructed context or downstream serialized task).