Skip to content

Mode service account in target namespace - #693

Open
olevitt wants to merge 8 commits into
mainfrom
mode-serviceaccount-in-target-namespace
Open

olevitt wants to merge 8 commits into
mainfrom
mode-serviceaccount-in-target-namespace

Conversation

@olevitt

@olevitt olevitt commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

Fix #688 and #72

olevitt and others added 8 commits October 23, 2026 14:21
… call

In serviceAccountInTargetNamespace mode, the fabric8 client now also
impersonates the namespace service account (logs, events, Onyxia
secrets, pods, workload health, namespace check and quota), not only
Helm. The API service account only needs the impersonate verb on that
service account.

- the service account name is configurable per region with
  services.targetNamespaceServiceAccount (default onyxia-local)
- namespace creation by the API is deprecated, and disabled in this
  mode: namespaces must be created by the onboarding API

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
In serviceAccountInTargetNamespace mode, the secret is now created by
impersonating the namespace service account, like every other call.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@sonarqubecloud

sonarqubecloud Bot commented Nov 2, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security : run helm installs / upgrades / uninstalls as a service account local to the target namespace

2 participants