[Feature]: Allow custom ServiceAccount for DCGM Exporter DaemonSet
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 2.9k
- Forks
- 552
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 90
Description
Problem
GPU Operator hardcodes the DCGM Exporter ServiceAccount to nvidia-dcgm-exporter (assets + DaemonSet). DCGMExporterSpec has no serviceAccount / serviceAccountName field, and TransformDCGMExporter never overrides it. Helm/ClusterPolicy cannot change it; patches are reverted on reconcile.
Request
Add ClusterPolicy/Helm support to configure the DCGM Exporter SA, with default behavior unchanged:
dcgmExporter:
serviceAccount:
create: false # true = operator creates SA (current behavior)
name: my-metrics-identity # default: nvidia-dcgm-exporter
- Default unset → keep creating/using
nvidia-dcgm-exporter(backward compatible). create: false→ use an existing SA in the operator namespace; bind Role/ClusterRoleBindings to that SA.- Document that SAs are namespaced (cross-namespace SA is out of scope).
Why
Enterprise platforms bind identity/PKI/IRSA/Workload Identity to a specific SA name. Without this, users must run a standalone exporter, vendor-patch the operator, or use fragile admission mutators.
Pros
- Keep using the operator-managed DCGM Exporter (no parallel DaemonSet).
- Fit org identity/IAM/PKI SA naming requirements.
- Align with existing per-component knobs (
dcgmExporter.annotations, env, serviceMonitor). - Backward compatible; reduces forks/mutators/reconcile fights.
References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with DCGMExporterSpec and TransformDCGMExporter, then inspect assets/state-dcgm-exporter/0100_service_account.yaml and 0800_daemonset.yaml. Trace the ClusterPolicy and Helm configuration path, including the Role and ClusterRoleBinding resources. Done means custom names and create behavior work in the operator namespace, while an unset configuration preserves the existing ServiceAccount behavior and the namespaced limitation is documented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, helm, kubernetes
- Domain
- infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100