Skip to content

Commit

Permalink
Add note on configuring provider service accounts
Browse files Browse the repository at this point in the history
Signed-off-by: Hasan Turken <[email protected]>
  • Loading branch information
turkenh committed Sep 11, 2024
1 parent 5dbfab8 commit 3b6da48
Show file tree
Hide file tree
Showing 4 changed files with 64 additions and 0 deletions.
16 changes: 16 additions & 0 deletions content/master/concepts/providers.md
Original file line number Diff line number Diff line change
Expand Up @@ -766,6 +766,22 @@ spec:
name: my-service-account
```

<!-- vale gitlab.FutureTense = NO -->
{{<hint "important" >}}
Setting the `serviceAccountTemplate.metadata.name` field will override the
name of service account created by the package manager and used in the
provider deployment. The package manager will own that service account and
may conflict with other owners attempting to take ownership. A common mistake
is configuring the same service account for multiple packages in this way
which ends up causing frequent reconciliation loops and loads on the API server.

If you just want to use an existing service account, you should instead only
set the `deploymentTemplate.spec.template.spec.serviceAccountName` field.
Crossplane will then use the existing service account without taking the ownership
and still take care of binding the necessary permissions.
{{</hint >}}
<!-- vale gitlab.FutureTense = YES -->

### Provider configuration

The `ProviderConfig` determines settings the Provider uses communicating to the
Expand Down
16 changes: 16 additions & 0 deletions content/v1.15/concepts/providers.md
Original file line number Diff line number Diff line change
Expand Up @@ -766,6 +766,22 @@ spec:
name: my-service-account
```

<!-- vale gitlab.FutureTense = NO -->
{{<hint "important" >}}
Setting the `serviceAccountTemplate.metadata.name` field will override the
name of service account created by the package manager and used in the
provider deployment. The package manager will own that service account and
may conflict with other owners attempting to take ownership. A common mistake
is configuring the same service account for multiple packages in this way
which ends up causing frequent reconciliation loops and loads on the API server.

If you just want to use an existing service account, you should instead only
set the `deploymentTemplate.spec.template.spec.serviceAccountName` field.
Crossplane will then use the existing service account without taking the ownership
and still take care of binding the necessary permissions.
{{</hint >}}
<!-- vale gitlab.FutureTense = YES -->

### Provider configuration

The `ProviderConfig` determines settings the Provider uses communicating to the
Expand Down
16 changes: 16 additions & 0 deletions content/v1.16/concepts/providers.md
Original file line number Diff line number Diff line change
Expand Up @@ -766,6 +766,22 @@ spec:
name: my-service-account
```

<!-- vale gitlab.FutureTense = NO -->
{{<hint "important" >}}
Setting the `serviceAccountTemplate.metadata.name` field will override the
name of service account created by the package manager and used in the
provider deployment. The package manager will own that service account and
may conflict with other owners attempting to take ownership. A common mistake
is configuring the same service account for multiple packages in this way
which ends up causing frequent reconciliation loops and loads on the API server.

If you just want to use an existing service account, you should instead only
set the `deploymentTemplate.spec.template.spec.serviceAccountName` field.
Crossplane will then use the existing service account without taking the ownership
and still take care of binding the necessary permissions.
{{</hint >}}
<!-- vale gitlab.FutureTense = YES -->

### Provider configuration

The `ProviderConfig` determines settings the Provider uses communicating to the
Expand Down
16 changes: 16 additions & 0 deletions content/v1.17/concepts/providers.md
Original file line number Diff line number Diff line change
Expand Up @@ -766,6 +766,22 @@ spec:
name: my-service-account
```

<!-- vale gitlab.FutureTense = NO -->
{{<hint "important" >}}
Setting the `serviceAccountTemplate.metadata.name` field will override the
name of service account created by the package manager and used in the
provider deployment. The package manager will own that service account and
may conflict with other owners attempting to take ownership. A common mistake
is configuring the same service account for multiple packages in this way
which ends up causing frequent reconciliation loops and loads on the API server.

If you just want to use an existing service account, you should instead only
set the `deploymentTemplate.spec.template.spec.serviceAccountName` field.
Crossplane will then use the existing service account without taking the ownership
and still take care of binding the necessary permissions.
{{</hint >}}
<!-- vale gitlab.FutureTense = YES -->

### Provider configuration

The `ProviderConfig` determines settings the Provider uses communicating to the
Expand Down

0 comments on commit 3b6da48

Please sign in to comment.