Sebastian Schulze
08/26/2022, 9:10 AM@task(
requests=Resources(mem="512Mi", cpu="1"),
limits=Resources(mem="2Gi", cpu="1"),
task_config=Pod(
pod_spec=V1PodSpec(
containers=[V1Container(name="primary")],
service_account="<sa-name>",
service_account_name="<sa-name>"),
primary_container_name="primary",
),
)
However, when executing the workflow it seems that Flyte can no longer fetch the serialised Task inputs from the Flyte GCS bucket and fails with:
Error from command '['gsutil', 'cp', '<gs://flyte-store/metadata/propeller/default-development-fddb5e602ce594338828/n1/data/inputs.pb>', '/tmp/flyte-tz9k8etn/sandbox/local_flytekit/inputs.pb']':
...
raise exceptions.CommunicationError(\napitools.base.py.exceptions.CommunicationError: Could not reach metadata service: Forbidden\n
Interestingly when I put default
as sa-name
everything works fine and the two k8s service accounts are linked to the same gcp-service-account.
I would very much appreciate any pointers towards debugging this or other ways of setting up the Task to be executed with the new service account.
Cheers,
SebPrafulla Mahindrakar
08/26/2022, 9:52 AMSamhita Alla
Sebastian Schulze
08/26/2022, 1:23 PMFrank Shen
01/18/2023, 8:01 PMtask_config=Pod(
pod_spec=V1PodSpec(
containers=[V1Container(name="primary")],
service_account="<sa-name>",
service_account_name="<sa-name>"),
primary_container_name="primary",
),
Kevin Su
01/18/2023, 8:05 PM