Skip to content

add ServiceAccount to openshift template #118

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Aug 13, 2025
Merged

add ServiceAccount to openshift template #118

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions template.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -365,6 +365,15 @@ objects:
server:
port: ${LLAMA_STACK_SERVER_PORT}

- apiVersion: v1
kind: ServiceAccount
metadata:
name: assisted-chat
labels:
app: assisted-chat
imagePullSecrets:
- name: quay.io

Comment on lines +368 to +376
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Aug 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Verification agent

🧩 Analysis chain

Hardcoded imagePullSecret name will break in most clusters; parameterize and disable token automount

Referencing a Secret named "quay.io" is unlikely to work across environments. The Secret must pre-exist in the target namespace and is typically named by teams (e.g., quay-pull-secret). Also, for least-privilege, avoid mounting service account tokens when not needed.

  • Parameterize the pull secret name so the template remains portable.
  • Add automountServiceAccountToken: false to reduce token exposure.

Apply this diff within the ServiceAccount:

   kind: ServiceAccount
   metadata:
     name: assisted-chat
     labels:
       app: assisted-chat
-  imagePullSecrets:
-  - name: quay.io
+  automountServiceAccountToken: false
+  imagePullSecrets:
+  - name: ${IMAGE_PULL_SECRET_NAME}

Add this parameter to the template’s parameters section (outside this hunk):

- name: IMAGE_PULL_SECRET_NAME
  required: true
  description: "Name of an existing Secret (type kubernetes.io/dockerconfigjson) with quay.io credentials"

Verification:

  • Ensure the Secret ${IMAGE_PULL_SECRET_NAME} exists in the same namespace before applying the template.
  • Confirm it is of type kubernetes.io/dockerconfigjson.

If you want, I can add a Secret object to this template (disabled by default) or provide docs on how to create one with ‘oc create secret docker-registry …’.

I’ll verify the presence of parameters and the hardcoded pull secret reference in template.yaml. Once confirmed, I’ll rewrite the comment accordingly.

🏁 Script executed:

#!/bin/bash
# Locate template.yaml
file=$(fd template.yaml | head -n1)
echo "Using file: $file"

# Show parameters section (first 50 lines)
echo; echo "=== parameters section ==="
grep -R "parameters:" -n "$file" | head -n5
sed -n '1,50p' "$file"

# Show lines 350–400 around the ServiceAccount
echo; echo "=== lines 350–400 ==="
sed -n '350,400p' "$file"

# Confirm any existing IMAGE_PULL_SECRET_NAME parameter
grep -R "IMAGE_PULL_SECRET_NAME" -n "$file"

# Confirm hardcoded quay.io reference
grep -R "quay.io" -n "$file"

Length of output: 3642

Parameterize Image Pull Secret and Disable Service Account Token Automount

Hardcoding the imagePullSecret “quay.io” will fail in clusters where the pull‐secret is named differently or doesn’t exist. To keep this template portable and adhere to least‐privilege principles, please:

• Introduce a required parameter for the pull‐secret name.
• Set automountServiceAccountToken to false on the ServiceAccount.

Suggested changes in template.yaml:

--- a/template.yaml
+++ b/template.yaml
@@ parameters:
 - name: GEMINI_API_SECRET_NAME
   value: "assisted-chat-gemini-secret"
   description: "Name of the Kubernetes secret containing the Gemini API key"
+- name: IMAGE_PULL_SECRET_NAME
+  required: true
+  description: "Name of an existing Secret (type kubernetes.io/dockerconfigjson) for pulling images from quay.io"
 
@@ kind: ServiceAccount
   metadata:
     name: assisted-chat
     labels:
       app: assisted-chat
-  imagePullSecrets:
-  - name: quay.io
+  automountServiceAccountToken: false
+  imagePullSecrets:
+  - name: ${IMAGE_PULL_SECRET_NAME}

Before instantiating the template, ensure the named secret exists in the target namespace and is of type kubernetes.io/dockerconfigjson.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- apiVersion: v1
kind: ServiceAccount
metadata:
name: assisted-chat
labels:
app: assisted-chat
imagePullSecrets:
- name: quay.io
- apiVersion: v1
kind: ServiceAccount
metadata:
name: assisted-chat
labels:
app: assisted-chat
automountServiceAccountToken: false
imagePullSecrets:
- name: ${IMAGE_PULL_SECRET_NAME}
🤖 Prompt for AI Agents 
In template.yaml around lines 368 to 376, the ServiceAccount currently hardcodes
imagePullSecrets: - name: quay.io and does not disable token automount; change
this by adding a required template parameter (e.g., ImagePullSecretName) and
replace the hardcoded name with the parameter reference for the imagePullSecrets
entry, then add automountServiceAccountToken: false under the ServiceAccount
spec to disable token automount; also ensure the parameter is marked required in
the template parameters section so callers must provide the pull-secret name.

- apiVersion: apps/v1
kind: Deployment
metadata:
Expand All @@ -381,6 +390,7 @@ objects:
labels:
app: assisted-chat
spec:
serviceAccountName: assisted-chat
containers:
- name: lightspeed-stack
image: ${IMAGE}:${IMAGE_TAG}
Expand Down