https://flyte.org
Join Slack
Menu
Home
Archive
Is there any recommendation for how to support project specific IAM roles? e.g. right now, all flyte...
# flyte-deployment
n
Is there any recommendation for how to support project specific IAM roles? e.g. right now, all flyte pods use 
flyte-user-role
but what if I want project A to use flyte-user-role-A and project B to use flyte-user-role-B?
I see that there's support for domains. https://github.com/flyteorg/flyte/blob/4fc4988400b9f448f61fe796d5252c1aa075fe6f/charts/flyte-core/values-eks.yaml#L343-L365 looks like you can specify roles for diff domains
f
@numerous-hamburger-7178 every execution can use special iam roles, we recommend using service accounts for iam roles on eks
just set the default service accounts
n
How would I set it up so that a certain namespace uses a certain iam role?
Oh, I can use podtemplate's serviceAccountName?
e
The idea is that each (project, domain) pair defines a unique namespace, but you can have a common service account across thee namespaces so you don't need to set a different value in the pod template per project/domain pair.
We also have an additional requirement that we're building towards where writes to our data warehouse will require scoped credentials, but in that case we're planning on using an init container (where the init container has broader permissions but generates scoped credentials to a specific s3 prefix), and then mounts that in the main workflow container. That way, the user-controlled application code can only write to a specific location in our bucket but we can use a common serviceaccount for the pod across the board (in this case, however, we likely won't use IRSA)
n
In this case, I would like to set different service accounts across projects.
Would the right approach be defining the service accounts in PodTemplates?
f
Laura you can simply set it as a project config
Check flytectl
We are working on improving the UX
n
Copy code
--files.k8sServiceAccount
Oh, I see. passing this arg in when I run register files would help here.
If I do choose to use PodTemplates or something to set it, would flytectl override it with the default serviceaccount. Or more generally, is there a way to disallow other overrides of the serviceaccount after I set it once in some infra level
3 Views
Open in Slack
PreviousNext
Powered by

Flyte

Flyte enables production-grade orchestration for machine learning workflows and data processing created to accelerate local workflows to production.

Powered by