NVIDIA / NVIDIA/gpu-operator

[Feature]: Allow custom ServiceAccount for DCGM Exporter DaemonSet

Open
#2,729 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature lifecycle/frozen needs-triage
Dominant language
Go
Stars
2.9k
Forks
552
Avg merge
2d 4h
Merged PRs (30d)
90

Description

Problem

GPU Operator hardcodes the DCGM Exporter ServiceAccount to nvidia-dcgm-exporter (assets + DaemonSet). DCGMExporterSpec has no serviceAccount / serviceAccountName field, and TransformDCGMExporter never overrides it. Helm/ClusterPolicy cannot change it; patches are reverted on reconcile.

Request

Add ClusterPolicy/Helm support to configure the DCGM Exporter SA, with default behavior unchanged:

dcgmExporter:
  serviceAccount:
    create: false                 # true = operator creates SA (current behavior)
    name: my-metrics-identity     # default: nvidia-dcgm-exporter
  • Default unset → keep creating/using nvidia-dcgm-exporter (backward compatible).
  • create: false → use an existing SA in the operator namespace; bind Role/ClusterRoleBindings to that SA.
  • Document that SAs are namespaced (cross-namespace SA is out of scope).

Why

Enterprise platforms bind identity/PKI/IRSA/Workload Identity to a specific SA name. Without this, users must run a standalone exporter, vendor-patch the operator, or use fragile admission mutators.

Pros

  • Keep using the operator-managed DCGM Exporter (no parallel DaemonSet).
  • Fit org identity/IAM/PKI SA naming requirements.
  • Align with existing per-component knobs (dcgmExporter.annotations, env, serviceMonitor).
  • Backward compatible; reduces forks/mutators/reconcile fights.

References

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with DCGMExporterSpec and TransformDCGMExporter, then inspect assets/state-dcgm-exporter/0100_service_account.yaml and 0800_daemonset.yaml. Trace the ClusterPolicy and Helm configuration path, including the Role and ClusterRoleBinding resources. Done means custom names and create behavior work in the operator namespace, while an unset configuration preserves the existing ServiceAccount behavior and the namespaced limitation is documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, helm, kubernetes
Domain
infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.