Skip to content

feat(supervisor): make run pod automountServiceAccountToken configurable #4302

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
danhngo-lx wants to merge 1 commit into from
Closed

feat(supervisor): make run pod automountServiceAccountToken configurable #4302

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .server-changes/kubernetes-worker-automount-service-account-token.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
area: supervisor
type: feature
---

Self-hosted Kubernetes deployments can now let run pods reach the Kubernetes API. A new option makes mounting the pod's service account token configurable (off by default), so workloads that need in-cluster access — like backup tooling — can be granted it.
8 changes: 8 additions & 0 deletions apps/supervisor/src/env.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,14 @@ export const Env = z
KUBERNETES_NAMESPACE: z.string().default("default"),
KUBERNETES_WORKER_NODETYPE_LABEL: z.string().default("v4-worker"),
KUBERNETES_IMAGE_PULL_SECRETS: z.string().optional(), // csv
// Mount an in-cluster ServiceAccount token/CA into run pods so workload code can reach the
// Kubernetes API (e.g. via @kubernetes/client-node or CLIs like velero/kubectl). Defaults to
// false to preserve the existing hardened behavior. Only enable when runs use a ServiceAccount
// with appropriately scoped RBAC.
KUBERNETES_WORKER_AUTOMOUNT_SERVICE_ACCOUNT_TOKEN: BoolEnv.default(false),
// ServiceAccount to run worker pods under. Only useful alongside
// KUBERNETES_WORKER_AUTOMOUNT_SERVICE_ACCOUNT_TOKEN=true; leaves the cluster default when unset.
KUBERNETES_WORKER_SERVICE_ACCOUNT_NAME: z.string().optional(),
KUBERNETES_EPHEMERAL_STORAGE_SIZE_LIMIT: z.string().default("10Gi"),
KUBERNETES_EPHEMERAL_STORAGE_SIZE_REQUEST: z.string().default("2Gi"),
KUBERNETES_STRIP_IMAGE_DIGEST: BoolEnv.default(false),
Expand Down
7 changes: 6 additions & 1 deletion apps/supervisor/src/workloadManager/kubernetes.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -317,8 +317,13 @@ export class KubernetesWorkloadManager implements WorkloadManager {
get #defaultPodSpec(): Omit<k8s.V1PodSpec, "containers"> {
return {
restartPolicy: "Never",
automountServiceAccountToken: false,
automountServiceAccountToken: env.KUBERNETES_WORKER_AUTOMOUNT_SERVICE_ACCOUNT_TOKEN,
imagePullSecrets: this.getImagePullSecrets(),
...(env.KUBERNETES_WORKER_SERVICE_ACCOUNT_NAME
? {
serviceAccountName: env.KUBERNETES_WORKER_SERVICE_ACCOUNT_NAME,
}
: {}),
...(env.KUBERNETES_SCHEDULER_NAME
? {
schedulerName: env.KUBERNETES_SCHEDULER_NAME,
Expand Down
2 changes: 2 additions & 0 deletions docs/self-hosting/env/supervisor.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ mode: "wide"
| `KUBERNETES_NAMESPACE` | No | default | The namespace that runs should be in. |
| `KUBERNETES_WORKER_NODETYPE_LABEL` | No | v4-worker | Nodes for runs need this label, e.g. `nodetype=v4-worker`. |
| `KUBERNETES_IMAGE_PULL_SECRETS` | No | — | Image pull secrets (CSV). |
| `KUBERNETES_WORKER_AUTOMOUNT_SERVICE_ACCOUNT_TOKEN` | No | false | Mount an in-cluster ServiceAccount token/CA into run pods so workloads can reach the Kubernetes API. Enable only with scoped RBAC. |
| `KUBERNETES_WORKER_SERVICE_ACCOUNT_NAME` | No | — | ServiceAccount to run worker pods under. Pairs with the automount option above. |
| `KUBERNETES_EPHEMERAL_STORAGE_SIZE_LIMIT` | No | 10Gi | Ephemeral storage size limit. Applies to all runs. |
| `KUBERNETES_EPHEMERAL_STORAGE_SIZE_REQUEST` | No | 2Gi | Ephemeral storage size request. Applies to all runs. |
| **Metrics** | | | |
Expand Down