add ServiceAccount to openshift template#118
add ServiceAccount to openshift template#118openshift-merge-bot[bot] merged 1 commit intorh-ecosystem-edge:mainfrom
Conversation
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: maorfr The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
WalkthroughIntroduces a ServiceAccount named assisted-chat with imagePullSecrets for quay.io and updates the assisted-chat Deployment to use this ServiceAccount via serviceAccountName. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
template.yaml (1)
393-393: Good: Deployment now uses the dedicated ServiceAccount; consider disabling token automount at Pod levelserviceAccountName is correctly set. For additional hardening (if the app doesn’t need in-cluster API), disable token automount at the Pod level as well.
Suggested diff:
spec: - serviceAccountName: assisted-chat + serviceAccountName: assisted-chat + automountServiceAccountToken: falsePlease confirm the containers don’t need Kubernetes API access; otherwise, skip this change.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
template.yaml(2 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: Red Hat Konflux / assisted-chat-saas-main-on-pull-request
| - apiVersion: v1 | ||
| kind: ServiceAccount | ||
| metadata: | ||
| name: assisted-chat | ||
| labels: | ||
| app: assisted-chat | ||
| imagePullSecrets: | ||
| - name: quay.io | ||
|
|
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Hardcoded imagePullSecret name will break in most clusters; parameterize and disable token automount
Referencing a Secret named "quay.io" is unlikely to work across environments. The Secret must pre-exist in the target namespace and is typically named by teams (e.g., quay-pull-secret). Also, for least-privilege, avoid mounting service account tokens when not needed.
- Parameterize the pull secret name so the template remains portable.
- Add automountServiceAccountToken: false to reduce token exposure.
Apply this diff within the ServiceAccount:
kind: ServiceAccount
metadata:
name: assisted-chat
labels:
app: assisted-chat
- imagePullSecrets:
- - name: quay.io
+ automountServiceAccountToken: false
+ imagePullSecrets:
+ - name: ${IMAGE_PULL_SECRET_NAME}Add this parameter to the template’s parameters section (outside this hunk):
- name: IMAGE_PULL_SECRET_NAME
required: true
description: "Name of an existing Secret (type kubernetes.io/dockerconfigjson) with quay.io credentials"Verification:
- Ensure the Secret ${IMAGE_PULL_SECRET_NAME} exists in the same namespace before applying the template.
- Confirm it is of type kubernetes.io/dockerconfigjson.
If you want, I can add a Secret object to this template (disabled by default) or provide docs on how to create one with ‘oc create secret docker-registry …’.
I’ll verify the presence of parameters and the hardcoded pull secret reference in template.yaml. Once confirmed, I’ll rewrite the comment accordingly.
🏁 Script executed:
#!/bin/bash
# Locate template.yaml
file=$(fd template.yaml | head -n1)
echo "Using file: $file"
# Show parameters section (first 50 lines)
echo; echo "=== parameters section ==="
grep -R "parameters:" -n "$file" | head -n5
sed -n '1,50p' "$file"
# Show lines 350–400 around the ServiceAccount
echo; echo "=== lines 350–400 ==="
sed -n '350,400p' "$file"
# Confirm any existing IMAGE_PULL_SECRET_NAME parameter
grep -R "IMAGE_PULL_SECRET_NAME" -n "$file"
# Confirm hardcoded quay.io reference
grep -R "quay.io" -n "$file"Length of output: 3642
Parameterize Image Pull Secret and Disable Service Account Token Automount
Hardcoding the imagePullSecret “quay.io” will fail in clusters where the pull‐secret is named differently or doesn’t exist. To keep this template portable and adhere to least‐privilege principles, please:
• Introduce a required parameter for the pull‐secret name.
• Set automountServiceAccountToken to false on the ServiceAccount.
Suggested changes in template.yaml:
--- a/template.yaml
+++ b/template.yaml
@@ parameters:
- name: GEMINI_API_SECRET_NAME
value: "assisted-chat-gemini-secret"
description: "Name of the Kubernetes secret containing the Gemini API key"
+- name: IMAGE_PULL_SECRET_NAME
+ required: true
+ description: "Name of an existing Secret (type kubernetes.io/dockerconfigjson) for pulling images from quay.io"
@@ kind: ServiceAccount
metadata:
name: assisted-chat
labels:
app: assisted-chat
- imagePullSecrets:
- - name: quay.io
+ automountServiceAccountToken: false
+ imagePullSecrets:
+ - name: ${IMAGE_PULL_SECRET_NAME}Before instantiating the template, ensure the named secret exists in the target namespace and is of type kubernetes.io/dockerconfigjson.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: assisted-chat | |
| labels: | |
| app: assisted-chat | |
| imagePullSecrets: | |
| - name: quay.io | |
| - apiVersion: v1 | |
| kind: ServiceAccount | |
| metadata: | |
| name: assisted-chat | |
| labels: | |
| app: assisted-chat | |
| automountServiceAccountToken: false | |
| imagePullSecrets: | |
| - name: ${IMAGE_PULL_SECRET_NAME} |
🤖 Prompt for AI Agents
In template.yaml around lines 368 to 376, the ServiceAccount currently hardcodes
imagePullSecrets: - name: quay.io and does not disable token automount; change
this by adding a required template parameter (e.g., ImagePullSecretName) and
replace the hardcoded name with the parameter reference for the imagePullSecrets
entry, then add automountServiceAccountToken: false under the ServiceAccount
spec to disable token automount; also ensure the parameter is marked required in
the template parameters section so callers must provide the pull-secret name.
eranco74
left a comment
eranco74
left a comment
There was a problem hiding this comment.
/lgtm
/cc @andrej1991 though I don't think it should have an effect on the CI job
openshift-merge-bot
bot
merged commit cebff1a
into
rh-ecosystem-edge:main
2 participants
part of https://issues.redhat.com/browse/MGMT-21020
adding a ServiceAccount to avoid using
defaultand also using a pull secret for auth.Summary by CodeRabbit