Skip to content

Commit 296d352

Browse files
matifalimatifali
committed
test service_account_name 
1 parent d3f57b0 commit 296d352

File tree

4 files changed

+40
-39
lines changed

4 files changed

+40
-39
lines changed

‎.github/pr-deployments/rbac.yaml

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
apiVersion: v1
22
kind: ServiceAccount
33
metadata:
4-
name: coder-workspace
4+
name: coder-workspace-pr${PR_NUMBER}
55
namespace: pr${PR_NUMBER}
6-
secrets:
7-
- name: coder-workspace-token
6+
# secrets:
7+
# - name: coder-workspace-token
88

99
---
1010
apiVersion: rbac.authorization.k8s.io/v1
1111
kind: Role
1212
metadata:
13-
name: coder-workspace
13+
name: coder-workspace-pr${PR_NUMBER}
1414
namespace: pr${PR_NUMBER}
1515
rules:
1616
- apiGroups: ["*"]
@@ -21,23 +21,23 @@ rules:
2121
apiVersion: rbac.authorization.k8s.io/v1
2222
kind: RoleBinding
2323
metadata:
24-
name: coder-workspace
24+
name: coder-workspace-pr${PR_NUMBER}
2525
namespace: pr${PR_NUMBER}
2626
subjects:
2727
- kind: ServiceAccount
28-
name: coder-workspace
28+
name: coder-workspace-pr${PR_NUMBER}
2929
namespace: pr${PR_NUMBER}
3030
roleRef:
3131
apiGroup: rbac.authorization.k8s.io
3232
kind: Role
33-
name: coder-workspace
33+
name: coder-workspace-pr${PR_NUMBER}
3434

35-
---
36-
apiVersion: v1
37-
kind: Secret
38-
metadata:
39-
name: coder-workspace-token
40-
namespace: pr${PR_NUMBER}
41-
annotations:
42-
kubernetes.io/service-account.name: coder-workspace
43-
type: kubernetes.io/service-account-token
35+
# ---
36+
# apiVersion: v1
37+
# kind: Secret
38+
# metadata:
39+
# name: coder-workspace-token-pr${PR_NUMBER}
40+
# namespace: pr${PR_NUMBER}
41+
# annotations:
42+
# kubernetes.io/service-account.name: coder-workspace
43+
# type: kubernetes.io/service-account-token

‎.github/pr-deployments/template/main.tf

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -115,10 +115,10 @@ resource "coder_agent" "main" {
115115
curl -fsSL https://code-server.dev/install.sh | sh -s -- --method=standalone --prefix=/tmp/code-server
116116
/tmp/code-server/bin/code-server --auth none --port 13337 >/tmp/code-server.log 2>&1 &
117117
118-
# Set KUBECONFIG env var to the path of the mounted secret
119-
mkdir -p /home/coder/.kube
120-
sudo cp /tmp/config /home/coder/.kube/config
121-
export KUBECONFIG=/home/coder/.kube/config
118+
# # Set KUBECONFIG env var to the path of the mounted secret
119+
# mkdir -p /home/coder/.kube
120+
# sudo cp /tmp/config /home/coder/.kube/config
121+
# export KUBECONFIG=/home/coder/.kube/config
122122
123123
EOT
124124

@@ -271,6 +271,7 @@ resource "kubernetes_deployment" "main" {
271271
fs_group = 1000
272272
}
273273

274+
service_account_name = "coder-workspace-${var.namespace}"
274275
container {
275276
name = "dev"
276277
image = "bencdr/devops-tools"

‎.github/pr-deployments/values.yaml

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,15 @@ coder:
1414
enable: true
1515
secretName: pr${PR_NUMBER}-tls
1616
wildcardSecretName: pr${PR_NUMBER}-tls
17-
volumes:
18-
- name: coder-namespace-kubeconfig
19-
secret:
20-
secretName: coder-namespace-kubeconfig
21-
volumeMounts:
22-
- name: coder-namespace-kubeconfig
23-
mountPath: /home/coder/.kube/config
24-
subPath: kubeconfig
25-
readOnly: true
17+
# volumes:
18+
# - name: coder-namespace-kubeconfig
19+
# secret:
20+
# secretName: coder-namespace-kubeconfig
21+
# volumeMounts:
22+
# - name: coder-namespace-kubeconfig
23+
# mountPath: /home/coder/.kube/config
24+
# subPath: kubeconfig
25+
# readOnly: true
2626
env:
2727
- name: "CODER_ACCESS_URL"
2828
value: "https://${PR_DEPLOYMENT_ACCESS_URL}"

‎.github/workflows/pr-deploy.yaml

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -303,21 +303,21 @@ jobs:
303303
if: needs.get_info.outputs.NEW == 'true' || github.event.inputs.deploy == 'true'
304304
run: |
305305
set -euo pipefail
306-
# Create service account, role, rolebinding and secret
306+
# Create service account, role, rolebinding
307307
envsubst < ./.github/pr-deployments/rbac.yaml | kubectl apply -f -
308308
309-
# Get the token for the service account
310-
export TOKEN=$(kubectl -n pr${{ env.PR_NUMBER }} get secret coder-workspace-token -o jsonpath='{.data.token}' | base64 --decode)
309+
# # Get the token for the service account
310+
# export TOKEN=$(kubectl -n pr${{ env.PR_NUMBER }} get secret coder-workspace-token -o jsonpath='{.data.token}' | base64 --decode)
311311
312-
# get CLUSTER_CA and CLUSTER_ENDPOINT
313-
export CLUSTER_CA=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}')
314-
export CLUSTER_ENDPOINT=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.server}')
312+
# # get CLUSTER_CA and CLUSTER_ENDPOINT
313+
# export CLUSTER_CA=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}')
314+
# export CLUSTER_ENDPOINT=$(kubectl config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.server}')
315315
316-
# Create a kubeconfig for the namespace to be used in the workspace
317-
envsubst < ./.github/pr-deployments/kubeconfig.yaml > ./namespace-kubeconfig.yaml
316+
# # Create a kubeconfig for the namespace to be used in the workspace
317+
# envsubst < ./.github/pr-deployments/kubeconfig.yaml > ./namespace-kubeconfig.yaml
318318
319-
# Create a secret from the kubeconfig
320-
kubectl create secret generic coder-namespace-kubeconfig -n pr${{ env.PR_NUMBER }} --from-file=kubeconfig=./namespace-kubeconfig.yaml
319+
# # Create a secret from the kubeconfig
320+
# kubectl create secret generic coder-namespace-kubeconfig -n pr${{ env.PR_NUMBER }} --from-file=kubeconfig=./namespace-kubeconfig.yaml
321321
322322
- name: Create values.yaml
323323
if: github.event_name == 'workflow_dispatch'

0 commit comments

Comments
 (0)