Image Pull Secrets for Jobs

[akath19]

Hi,

I've been testing Starboard on GKE with Workload Identity (basically a way of automatically authenticating workloads against GCP via annotations on ServiceAccounts) for a few days and after a lot of debugging I have a few questions that might end up being a bug or enhancement:

Issue: When starboard is installed (via init) the starboard ServiceAccount is created in the starboard namespace, however, it isn't used at all for running jobs, the default ServiceAccount is used instead, I found this after digging through the code to find this, this leads me to a couple of questions

Questions:

1. Should the starboard ServiceAccount be used as a centralized config for ImagePullSecrets?
2. Why do all jobs run with the default ServiceAccount in the starboard namespace
3. Should the ServiceAccount a job runs as be configurable?

[danielpacak]

👋 Thank you for your questions @akath19

1. Should the starboard ServiceAccount be used as a centralized config for ImagePullSecrets?

IIRC in v0.4.0 we do not use starboard ServiceAccount consistently. However, it's been fixed on the main branch so each scanner runs as starboard ServiceAccount. I did check that, but if it's not the case please file an issue.

2. Why do all jobs run with the default ServiceAccount in the starboard namespace

It's our legacy when we prototyped Starboard

3. Should the ServiceAccount a job runs as be configurable

Since the init command creates the starboard ServiceAccount and then it's used in a few places in the code already, I'd not make it configurable. However, if we collect some real use cases and prove it's valuable we can always do that.

[akath19]

Awesome, I noticed that it's already fixed on main but I wasn't sure if it was going to stay that way, thanks!