https://prefect.io
Join Slack
Has anyone ever attached a service account to their agent with helm? I’m getting 403s after attachin...
# ask-community
l
Has anyone ever attached a service account to their agent with helm? I’m getting 403s after attaching a service account - including error message in thread
Copy code
"Failure","message":"jobs.batch is forbidden: User \"system:serviceaccount:default:prefect-agent\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"default\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403}
k
Did you set the env variable to define the service account?
Copy code
- name: SERVICE_ACCOUNT_NAME
  value: ''
l
is that for the flow or the agent?
a
for the agent. You can get the full template this way:
Copy code
prefect agent kubernetes install >> k8s.yaml
l
I’m thinking this is more on the k8s side because of this:
Copy code
kubectl auth can-i --as=system:serviceaccount:default:prefect-agent create jobs -n default
this yields 
no
does that env var just override this:
Copy code
subjects:
  - kind: ServiceAccount
    name: default
in the RoleBinding?
k
Will ask someone who knows more than me
l
I got it to work (I believe)
🚀 2
t
what was the trick?
l
In my 
rolebinding.yaml
Copy code
subjects:
  - kind: ServiceAccount
    name: {{ include "<CHART_NAME>.fullname" . }}
Removed the 403 error I was getting
My flow is noop-ing but I’m not exactly sure if its related to this
Also - the service account is defined in a 
serviceaccount.yaml
- so it inherits from the chart fullname
Open in Slack
PreviousNext
Powered by

Prefect Community

Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Powered by