Merge pull request #3856 from yuvipanda/user-sa

Move service account specification to basehub
2i2c-org · Mar 27, 2024 · d858a4b · d858a4b
2 parents c4d9839 + c2bd154
commit d858a4b
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/config/clusters/nasa-esdis/common.values.yaml b/config/clusters/nasa-esdis/common.values.yaml
@@ -52,7 +52,6 @@ jupyterhub:
     # We want to access IAM roles here, even though this is not set up to use dask
     cloudMetadata:
       blockWithIptables: false
-    serviceAccountName: user-sa
     defaultUrl: /lab
     profileList:
       - display_name: "Modified Pangeo Notebook"

diff --git a/helm-charts/basehub/values.yaml b/helm-charts/basehub/values.yaml
@@ -244,6 +244,11 @@ jupyterhub:
         limits:
           memory: 1Gi
   singleuser:
+    # basehub creates a k8s ServiceAccount for the hubs users that isn't granted
+    # permissions to the k8s api-server or other resources by default. Cloud
+    # infra permissions can be granted to all users by declaring annotations on
+    # this k8s ServiceAccount via basehub config userServiceAccount.annotations.
+    serviceAccountName: user-sa
     # Need to explicitly fix ownership here, as otherwise these directories will be owned
     # by root on most NFS filesystems - neither EFS nor Google Filestore support anonuid
     #

diff --git a/helm-charts/daskhub/values.yaml b/helm-charts/daskhub/values.yaml
@@ -15,7 +15,6 @@ basehub:
         # storage buckets.
         #
         blockWithIptables: false
-      serviceAccountName: user-sa
       extraEnv:
         # About DASK_ prefixed variables we set:
         #