Is there any recommendation for how to support project speci

Question

Is there any recommendation for how to support project specific IAM roles e g right now all flyte pods use `flyte user role` but what if I want project A to use flyte user role A and project B to use flyte user role B

Laura Lin · Answer

I see that there s support for domains <https github com flyteorg flyte blob 4fc4988400b9f448f61fe796d5252c1aa075fe6f charts flyte core values eks yaml L343 L365> looks like you can specify roles for diff domains

Ketan (kumare3) · Answer

< Laura Lin> every execution can use special iam roles we recommend using service accounts for iam roles on eks

Ketan (kumare3) · Answer

just set the default service accounts

Laura Lin · Answer

How would I set it up so that a certain namespace uses a certain iam role

Laura Lin · Answer

Oh I can use podtemplate s serviceAccountName

Rahul Mehta · Answer

The idea is that each project domain pair defines a unique namespace but you can have a common service account across thee namespaces so you don t need to set a different value in the pod template per project domain pair

Rahul Mehta · Answer

We also have an additional requirement that we re building towards where writes to our data warehouse will require scoped credentials but in that case we re planning on using an init container where the init container has broader permissions but generates scoped credentials to a specific s3 prefix and then mounts that in the main workflow container That way the user controlled application code can only write to a specific location in our bucket but we can use a common serviceaccount for the pod across the board in this case however we likely won t use IRSA

Laura Lin · Answer

In this case I would like to set different service accounts across projects

Laura Lin · Answer

Would the right approach be defining the service accounts in PodTemplates

Ketan (kumare3) · Answer

Laura you can simply set it as a project config

Ketan (kumare3) · Answer

Check flytectl

Ketan (kumare3) · Answer

We are working on improving the UX

Laura Lin · Answer

``` files k8sServiceAccount``` Oh I see passing this arg in when I run register files would help here

Laura Lin · Answer

If I do choose to use PodTemplates or something to set it would flytectl override it with the default serviceaccount Or more generally is there a way to disallow other overrides of the serviceaccount after I set it once in some infra level