Hello again I m trying to apply `defaultIamRole` and ideally

Question

Hello again I m trying to apply `defaultIamRole` and ideally `projectQuotaCpu` `projectQuotaMemory` if that s still possible to the pods that run in dev stag prod namespaces across all projects To do this I m using the `configuration inline cluster resources` entry see <https github com flyteorg flyte blob d60c9af85a59ebb4c2265f76cb082b992078a309 charts flyte binary eks production yaml L30 L41|prod values> When I deploy the chart with these values I can see that these exist under `010 inline config yaml` in the flyte backend flyte binary config configmap but I don t think these values are picked up by the namespaces For instance I would expect the default sa in each namespace dev stag prod to have a `role arn` annotation but it doesn t Have I missed something very obvious

Ed Fincham · Answer

I noticed that this was alluded to in this thread < Yee> you mentioned that you can add this info back to the inline section but under the admin namespace Can you explain what you mean by the admin namespace as I m a bit confused by that slightly smiling face

Yee · Answer

the bit that you referred to is for the cluster resource controller those are the values and they can differ by domain as you can see there

Yee · Answer

the cluster resource controller then reads those values and applies them where you tell them to but it won t apply it to the default service account if you don t tell it to

Yee · Answer

our default values are a bit incomplete we need to update them

Yee · Answer

basically that example only configures the `spark` service account

Yee · Answer

just copy paste that and change the name to `default` so that it also configures the default service account

Ed Fincham · Answer

Fantastic thank you By copy paste and update are you referring to the cluster resource template section <https github com flyteorg flyte blob d60c9af85a59ebb4c2265f76cb082b992078a309 charts flyte binary eks production yaml L79 L122>

Yee · Answer

yeah

Yee · Answer

oh no

Yee · Answer

not that whole thing just the service account

Yee · Answer

just add this

Yee · Answer

``` 042 def service account yaml | apiVersion v1 kind ServiceAccount metadata name default namespace namespace annotations <http eks amazonaws com role arn|eks amazonaws com role arn> defaultIamRole ```

Ed Fincham · Answer

Perfect thank you

Ed Fincham · Answer

Hi < Yee> Still having some issues here I have the following in my values yaml ```configuration inline cluster resources customData production defaultIamRole value lt IAM ROLE ARN gt staging defaultIamRole value lt IAM ROLE ARN gt development defaultIamRole value lt IAM ROLE ARN gt clusterResourceTemplates inline 001 namespace yaml | apiVersion v1 kind Namespace metadata name namespace 042 def service account yaml | apiVersion v1 kind ServiceAccount metadata name default namespace namespace annotations defaultIamRole ``` I found that I needed to add `001 namespace yaml` or else the project specific namespaces were not created However the default sa in each namespace does not have that role arn annotation I can see that the `flyte backend flyte binary cluster resource templates` config map does correctly contain the inline cluster resource templates I can also see that the the `cluster resources` are contained in a file at ` etc flyte config d 010 inline config yaml` on the main flyte pod So it seems like everything is in place but the annotation is not added to the default sa Moreoever it s not clear that the `042 def service account yaml` does anything If I edit the name and update the helm chart there is no such service account created in any namespace I m all out of ideas at this point slightly smiling face

Ed Fincham · Answer

Hey < Yee> if you have any thoughts on the above I would really appreciate the help slightly smiling face

Ed Fincham · Answer

Managed to fix it For future reference the issue was that in the default the flyte controller does not have the required permissions to edit service accounts Copying the following from the gave the required rbac ```rbac extraRules apiGroups resources serviceaccounts verbs create get list patch update apiGroups resources rolebindings roles verbs create get list patch update``` Simple fix in the end but took some time to figure out slightly smiling face

Yee · Answer

oohh sorry

Yee · Answer

thank you for digging through this

Yee · Answer

we will update

Yee · Answer

< Peeter Piegaze> could we get this added to the docs somewhere

Peeter Piegaze · Answer

< Yee> Docs issue opened