hi how do I check the k8s configs for worker, similar to how I checked `prefect kubernetes manifest ...

Vicky Kwan

09/14/2023, 9:45 PM

hi how do I check the k8s configs for worker, similar to how I checked

prefect kubernetes manifest agent

? It says

... worker

isn't valid

Nate

09/14/2023, 9:47 PM

hey @Vicky Kwan - you can check out the helm chart

Vicky Kwan

09/14/2023, 9:56 PM

Hi @Nate thanks for the link! I'm actually having a bigger problem: I don't know how to pass the service account into a k8s worker pool, so the deployment can use this service account to access the correct namespace. the error I'm hitting is:

Vicky Kwan

09/14/2023, 9:56 PM

Vicky Kwan

09/14/2023, 9:57 PM

then I wanted to check what/where is this service account

system:serviceaccount:prefect:prefect-worker

, because in the pool config page I only set the service account name to be

prefect-api-key

Vicky Kwan

09/14/2023, 9:57 PM

which is the exact service account that I passed into our helm chart

Vicky Kwan

09/14/2023, 9:57 PM

how can I check: 1. which service account is this pool really using, and if not correct, I'll update to the correct one, 2. what permission set looks like for this service account, if I need to override, should I do it over

role.extraPermissions

on the chart? I want to peek into the base permission set first and see what we need to update to

Vicky Kwan

09/14/2023, 10:00 PM

3. I don't quite get it why it's looking for

kube-system

while I specified a new namespace

prefect

Nate

09/14/2023, 10:02 PM

if you go into

Edit

on your k8s work pool, you should see

Nate

09/14/2023, 10:03 PM

and these should match your specifications in the helm chart to make sure your permissions work as expected

Vicky Kwan

09/14/2023, 10:09 PM

I tried that to match with the namespace and service account (on the org service accounts page right?) but still seeing the same error

Nate

09/14/2023, 10:10 PM

your service account is called

prefect-api-key

Nate

09/14/2023, 10:10 PM

seems like that would be the name of your k8s secret holding your api key

Nate

09/14/2023, 10:11 PM

the service account in this context refers to the kubernetes service account - if you didnt configure yourself manually, i would leave it at the default on the helm chart and here on the work pool

Vicky Kwan

09/15/2023, 9:03 PM

thanks Nate! turned out we needed to explicitly set the

cluster.Uid

and I also found another similar thread in here somewhere

Open in Slack

Previous Next

Prefect Community

Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.