[CONNECT] Allow use of rbac and service account creation without requiring launcher be enabled
Nobody has claimed this yet.
- Dominant language
- Markdown
- Stars
- 46
- Forks
- 40
- Avg merge
- 4h 3m
- Merged PRs (30d)
- 6
Description
When trying to create a service account using
rbac:
create: True
serviceAccount:
create: True
name: connect-sa
annotations:
eks.amazonaws.com/role-arn: <my-arn-here>
it became clear that we cannot create a service account in this method without enabling launcher because of this line. I am able to work around it thanks to @colearendt by using extraObjects to create the service account, making sure to specify it's name in the rbac values, because it's used later here even though we cannot create that service account that way.
It would be nice if we could support creating the service account without requiring launcher being enabled.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with charts/rstudio-connect/templates/rbac.yaml, especially the launcher condition linked in the issue, then inspect charts/rstudio-connect/templates/deployment.yaml to see how the service-account name is consumed. Confirm the chart can create the configured service account and RBAC resources when launcher is disabled, while the deployment still references that account.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes, yaml
- Domain
- authorization, infrastructure
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100