visualization server wants kubernetes serivce account too (kubeflow#2822

) * visualization server wants kubernetes serivce account too * add ksa for visualization server and use this ksa for standalone and hosted deployment of visualization server * Use server name its ksa name * add sa to pipeline.yaml
rui5i · Jan 16, 2020 · 854f152 · 854f152
1 parent b384b33
commit 854f152
Show file tree

Hide file tree

Showing 5 changed files with 15 additions and 1 deletion.
diff --git a/manifests/gcp_marketplace/chart/kubeflow-pipelines/templates/pipeline.yaml b/manifests/gcp_marketplace/chart/kubeflow-pipelines/templates/pipeline.yaml
@@ -70,6 +70,13 @@ metadata:
 ---
 apiVersion: v1
 kind: ServiceAccount
+metadata:
+  name: ml-pipeline-visualizationserver
+  labels:
+    app.kubernetes.io/name: {{ .Release.Name }}
+---
+apiVersion: v1
+kind: ServiceAccount
 metadata:
   name: ml-pipeline
   labels:
@@ -608,6 +615,7 @@ spec:
           name: ml-pipeline-visualizationserver
           ports:
             - containerPort: 8888
+      serviceAccountName: ml-pipeline-visualizationserver
 ---
 apiVersion: apps/v1beta2
 kind: Deployment

diff --git a/manifests/kustomize/base/pipeline/kustomization.yaml b/manifests/kustomize/base/pipeline/kustomization.yaml
@@ -25,6 +25,7 @@ resources:
 - ml-pipeline-viewer-crd-deployment.yaml
 - ml-pipeline-viewer-crd-sa.yaml
 - ml-pipeline-visualization-deployment.yaml
+- ml-pipeline-visualization-sa.yaml
 - ml-pipeline-visualization-service.yaml
 - pipeline-runner-role.yaml
 - pipeline-runner-rolebinding.yaml

diff --git a/manifests/kustomize/base/pipeline/ml-pipeline-visualization-deployment.yaml b/manifests/kustomize/base/pipeline/ml-pipeline-visualization-deployment.yaml
@@ -19,3 +19,4 @@ spec:
         name: ml-pipeline-visualizationserver
         ports:
         - containerPort: 8888
+      serviceAccountName: ml-pipeline-visualizationserver
diff --git a/manifests/kustomize/base/pipeline/ml-pipeline-visualization-sa.yaml b/manifests/kustomize/base/pipeline/ml-pipeline-visualization-sa.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: ml-pipeline-visualizationserver
diff --git a/manifests/kustomize/gcp-workload-identity-setup.sh b/manifests/kustomize/gcp-workload-identity-setup.sh
@@ -21,7 +21,7 @@ SYSTEM_GSA=${SYSTEM_GSA:-$CLUSTER_NAME-kfp-system}
 USER_GSA=${USER_GSA:-$CLUSTER_NAME-kfp-user}
 
 # Kubernetes Service Account (KSA)
-SYSTEM_KSA=(ml-pipeline-ui)
+SYSTEM_KSA=(ml-pipeline-ui ml-pipeline-visualizationserver)
 USER_KSA=(pipeline-runner default) # default service account is used for container building, TODO: give it a specific name
 
 cat <<EOF