CODEWITHSUNDEEP
kubernetesservice-accounts
eljefedelrodeodeljefe
eljefedelrodeodeljefe

Reputation: 6811

How to configure a non-default serviceAccount on a deployment

My Understanding of this doc page is, that I can configure service accounts with Pods and hopefully also deployments, so I can access the k8s API in Kubernetes 1.6+. In order not to alter or use the default one I want to create service account and mount certificate into the pods of a deployment.

How do I achieve something similar like in this example for a deployment?

apiVersion: v1
kind: Pod
metadata:
   name: my-pod
spec:
  serviceAccountName: build-robot
  automountServiceAccountToken: false

Upvotes: 66

Views: 76862

Answers (2)

Neeraj Gahlawat
Neeraj Gahlawat

Reputation: 1689

kubernetes nginx-deployment.yaml where serviceAccountName: test-sa
used as non default service account

Link: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/

test-sa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test-ns

nginx-deployment.yaml

apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: nginx
      namespace: test-ns
    spec:
      strategy:
        type: Recreate
      selector:
        matchLabels:
          app: nginx
      replicas: 1 # tells deployment to run 1 pods matching the template
      template: # create pods using pod definition in this template
        metadata:
          labels:
            app: nginx
        spec:
          serviceAccountName: test-sa
          containers:
          - name: nginx
            image: nginx
            ports:
            - containerPort: 80

Upvotes: 3

MrHohn
MrHohn

Reputation: 1236

As you will need to specify 'podSpec' in Deployment as well, you should be able to configure the service account in the same way. Something like:

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: my-deployment
spec:
  template:
    # Below is the podSpec.
    metadata:
      name: ...
    spec:
      serviceAccountName: build-robot
      automountServiceAccountToken: false
      ...

Upvotes: 111

Related Questions