goauthentik / goauthentik/helm

Service Account and Volume Mounts Post-Deployment Split

Open
#171 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Mustache
Stars
183
Forks
69
Avg merge
14h 21m
Merged PRs (30d)
8

Description

I ran into a slight issue that happened since the helm chart split the worker and server deployment.
The worker will now happily generate a service account (via a non-configurable name), but the server deployment will use default. When combined with the volume configuration applying on both deployments, if you are using csi secret store to load in secrets from HashiCorp Vault there are SA's that need access where there used to be just one.

The most straight-forward way to fix this would probably be to just have the worker and server use the same service account once it is created, but for max-security deployments it might make more sense to make both the SAs **and** the volumes + volumeMounts individually configurable.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.