Answers: <p>Okay the answer to this is that you can set <code>spec.serviceAccountName</code> on the <code>dc</code> and the secrets are mounted.</p>
  
  <p>Annoyingly the same does not hold true for BuildConfig objects. They have an inconsistently named <code>spec.serviceAccount</code>. Setting that doesn’t mount any secrets associated with the <code>sa</code>. It also means your build isn’t an “image puller” until you explicitly set that up. So this configuration option appears pretty useless as at openshift 3.11.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-01-30T07:08:16.910Z
Answers: 2019-11-10T21:22:37.643Z
Answers: 2019-11-10T21:22:37.643Z
Answers: simbo1905
Body: <p>I am using helm charts to deploy some webhook handlers. The handlers need to connect to the cluster they are running on to deploy the configuration within it. It works but one step is tricky to move into the helm chart. When the chart makes the service account it gives it a randomly named secret:</p>
  
  <pre>
  $ oc describe sa sa-build-webhook-realworld
  Name:                sa-build-webhook-realworld
  Namespace:           your-eng2
  Labels:              app=sa-build-webhook-realworld
  Annotations:         
  Image pull secrets:  sa-build-webhook-realworld-dockercfg-4qz9g
  Mountable secrets:   <b>sa-build-webhook-realworld-token-bqtnw</b>
                       sa-build-webhook-realworld-dockercfg-4qz9g
  Tokens:              sa-build-webhook-realworld-token-bqtnw
                       sa-build-webhook-realworld-token-k7lq8
  Events:              &lt;none&gt;
  </pre>
  
  <p>I can grab that and set it on the deployment config with:</p>
  
  <pre><code>#https://codereview.stackexchange.com/a/212095/75693
  SECRET_NAME=$(
      oc describe sa sa-tag-realworld |
      awk -F': *' '
          $2  { KEY=$1 ; VALUE=$2;  }
          !$2 {          VALUE=$1; }
          KEY=="Mountable secrets" &amp;&amp; VALUE !~ /docker/ { print VALUE }
      '
  )
  oc set volume dc/webhook-realworld \
    --add --name=sa-secret-volume \
    --mount-path=/sa-secret-volume \
    --secret-name=$SECRET_NAME
  </code></pre>
  
  <p>I am trying to see if there is a way to do this declaratively in the chart yaml that creates the <code>dc</code> and <code>sa</code> at the same time which is <a href="https://github.com/ocd-scm/ocd-builder-webhook/tree/master/ocd-builder-webhook/templates" rel="nofollow noreferrer">here</a>. </p>
  
  <p>Is there a way to reference the generated service account secret from the deployment config in the chart?</p>
  
  <p>Or should I be trying to get helm/helmfile to do the command-line lookup as part of its work?</p>
  
Tags: <kubernetes><helm><openshift>
Title: declaratively mount a service account secret in OpenShift
UserDisplayName: simbo1905
ThreadText: # declaratively mount a service account secret in OpenShift
  
  (Asked by: username_0 on 2019-01-24)
  
  I am using helm charts to deploy some webhook handlers. The handlers need to connect to the cluster they are running on to deploy the configuration within it. It works but one step is tricky to move into the helm chart. When the chart makes the service account it gives it a randomly named secret:
  
  ```
  
  $ oc describe sa sa-build-webhook-realworld
  Name:                sa-build-webhook-realworld
  Namespace:           your-eng2
  Labels:              app=sa-build-webhook-realworld
  Annotations:         
  Image pull secrets:  sa-build-webhook-realworld-dockercfg-4qz9g
  Mountable secrets:   sa-build-webhook-realworld-token-bqtnw
                       sa-build-webhook-realworld-dockercfg-4qz9g
  Tokens:              sa-build-webhook-realworld-token-bqtnw
                       sa-build-webhook-realworld-token-k7lq8
  Events:              <none>
  
  ```
  
  I can grab that and set it on the deployment config with:
  
  ```
  #https://codereview.stackexchange.com/a/212095/75693
  SECRET_NAME=$(
      oc describe sa sa-tag-realworld |
      awk -F': *' '
          $2  { KEY=$1 ; VALUE=$2;  }
          !$2 {          VALUE=$1; }
          KEY=="Mountable secrets" && VALUE !~ /docker/ { print VALUE }
      '
  )
  oc set volume dc/webhook-realworld \
    --add --name=sa-secret-volume \
    --mount-path=/sa-secret-volume \
    --secret-name=$SECRET_NAME
  
  ```
  
  I am trying to see if there is a way to do this declaratively in the chart yaml that creates the `dc` and `sa` at the same time which is [here](https://github.com/ocd-scm/ocd-builder-webhook/tree/master/ocd-builder-webhook/templates).
  
  Is there a way to reference the generated service account secret from the deployment config in the chart?
  
  Or should I be trying to get helm/helmfile to do the command-line lookup as part of its work?
  
  **Tags:** kubernetes, helm, openshift
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-01-30. Score: 1
  
  Okay the answer to this is that you can set `spec.serviceAccountName` on the `dc` and the secrets are mounted.
  
  Annoyingly the same does not hold true for BuildConfig objects. They have an inconsistently named `spec.serviceAccount`. Setting that doesn’t mount any secrets associated with the `sa`. It also means your build isn’t an “image puller” until you explicitly set that up. So this configuration option appears pretty useless as at openshift 3.11.
  
  
  ---
  
  