Portainer service account not found about charts HOT 5 OPEN

Even if we update the name of the SA it won't work at least on TN Scale

Portainer can only work correctly when it is deployed in the portainer namespace.
And on TN Scale all NS are prefixed with ix-.
portainer/portainer#5156 (comment)

Given that helm users can change the SA name, this is low prio.

from charts.

Thank you for the quick answer. What if we could change the config of portainer to assume the SA with name ‘portainer’ instead? I just could’t find the option for this…

also, this name is in the common chart? Or can we add it just for portainer chart? I can try to make it work and send a PR if it’s welcome.

thank you!

from charts.

Thank you for the quick answer. What if we could change the config of portainer to assume the SA with name ‘portainer’ instead? I just could’t find the option for this…

also, this name is in the common chart? Or can we add it just for portainer chart? I can try to make it work and send a PR if it’s welcome.

thank you!

As the linked comment above says, its all hardcoded currently.
Even if the name matches, it will still try to look in the wrong namespace.

The name is in the portainer chart. But with the current design of the naming generation on the common, it would need a "hack".

But backtracking a bit.
I just installed portainer to check things up.
The fact that it displays namespaces/configmaps/secrets etc, means that it can see and use the ServiceAccount
The RBAC is tied to the SA, so without the SA it wouldnt be able to see any of those.

That being said, portainer's examples seem to suggest to use the built-in cluster-admin role.
We don't use that but we use a fully open ClusterRole

Which is tied to the service account.

So unless we miss some specific setting, I'm not sure what we should do. And I don't think start changing naming's around is a good idea, unless first the issue is pinpointed.

from charts.

Ok, I can investigate first and see what change makes it work.

Looking in the source code of portainer, it seems indeed hardcoded, but then... why is it configurable in their helm chart?

https://github.com/portainer/portainer/blob/067a7d148f2a71796420e9a5026d8d876a3fb745/api/kubernetes/cli/naming.go#L9-L12
https://github.com/portainer/portainer/blob/develop/api/kubernetes/cli/service_account.go#L22

if they would allow those to be configurable via CLI, we could override them, right? What other options do we have?

from charts.

As a workaround, I deployed this via fluxcd to my (k3s / TN Scale) cluster and everything works now, including the shell functionality, even tho portainer is deployed as Truecharts App.

apiVersion: v1
kind: Namespace
metadata:
  name: portainer
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: portainer-sa-clusteradmin
  namespace: portainer
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: portainer-crb-clusteradmin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: portainer-sa-clusteradmin
  namespace: portainer
---

from charts.