astonishing-lizard-78628
04/28/2022, 12:48 AMv1.0.0
that have partially broken the kubernetes_service_account
, i.e. some of our workflows are executing with the declared service account and some are just executing with default
. I'm still working on debugging it.astonishing-lizard-78628
04/28/2022, 1:16 AMflytectl get execution --admin.endpoint avflyteadmin.pdx.l5.woven-planet.tech:443 -p avexampleworkflows -d dev atbnkl5564m49swgmqxk --output yaml
...
securityContext:
runAs:
k8sServiceAccount: avexampleworkflows
astonishing-lizard-78628
04/28/2022, 1:17 AMsecurityContext:
runAs:
k8sServiceAccount: default
astonishing-lizard-78628
04/28/2022, 1:18 AMspec:
annotations: {}
authRole:
kubernetesServiceAccount: avexampleworkflows
but it is ending up as default
in the executionastonishing-lizard-78628
04/28/2022, 1:20 AMastonishing-lizard-78628
04/28/2022, 1:24 AMastonishing-lizard-78628
04/28/2022, 2:36 AMflytekit==0.23.0b1
is just too old. The workflows using default
are using that flytekit
version. Workflows picking up the correct service account are using a newer version of flytekit
. Working on confirming this...astonishing-lizard-78628
04/28/2022, 4:47 AMflytekit
versioning issue. @acceptable-policeman-57188 the issue is that in new Admin version when users run flyte-cli register-files
now --output-location-prefix
is required in order for ----kubernetes-service-account
to actually take effect.icy-agent-73298
04/28/2022, 5:17 AMacceptable-policeman-57188
now --output-location-prefix is required in order for ----kubernetes-service-account to actually take effect.
astonishing-lizard-78628
04/28/2022, 5:24 PMflyte-cli register-files --kubernetes-service-account <accountName>
my task pods no longer run with the declared service account (they run with "default") unless you also pass --output-location-prefixastonishing-lizard-78628
04/28/2022, 5:26 PM--kubernetes-service-account <accountName>
alone was good enough.astonishing-lizard-78628
04/28/2022, 5:28 PMacceptable-policeman-57188
acceptable-policeman-57188