chore: add IRSA usage doc #1293
Conversation
|
No linked issues found. Please add the corresponding issues in the pull request description. |
|
|
|
||
| To make this work, you must ensure the following steps are completed: | ||
|
|
||
| > While Medusa is running in standalone mode, it uses the default service account from the namespace. Make sure this service account has the necessary role annotation. |
There was a problem hiding this comment.
Is this behavior acceptable ?
That means that the default service account needs to be properly annotated and needs to be properly bound with the AWS IAM role.
Therefore, any pods created without a SA specified will be granted with AWS permissions.
This against the least privilege principle - many of our customers won't accept this.
There was a problem hiding this comment.
Following this, just opened this issue #1294
There was a problem hiding this comment.
Totally agree, in my case, my project is not yet in production, so we have accepted the risk.
However, it is essential to be able to specify a specific "ServiceAccount" for Medusa standalone.
Each component should have complete customization of its spec.
|
FYI folks, this is in our current dev cycle. We'll probably end up removing this pod altogether since its original use case is no longer valid, and the one we had planned for (bootstrapping a new cluster using a backup) isn't implemented yet. |
What this PR does:
Adding doc about IAM role usage.
Which issue(s) this PR fixes:
Complete #1152
Checklist