-
Notifications
You must be signed in to change notification settings - Fork 423
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
switch trigger sa ref from global to namespace scoped #704
switch trigger sa ref from global to namespace scoped #704
Conversation
BTW, reducing the scope of https://github.com/tektoncd/triggers/blob/master/pkg/apis/triggers/v1alpha1/event_listener_types.go#L91 could also be a consderation, though maybe that is a bit muddied by any pre tektoncd/community#148 attempts to have a single event listener in one namespace manage triggers / interceptors in multilpe namespaces My thought was to tackle that possible discussion separately, but don't feel strongly about that. |
30c5269
to
7cd91e7
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
SGTM, the CLI basically ignores the SA field at the moment but this makes it future proof /approve |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dibyom, khrm The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Changes
So in getting caught up on some thing related to the trigger crd tep, I came across this type and #628
It appears to me that to some extent there was a simple copy done in #628 of https://github.com/tektoncd/triggers/blob/master/pkg/apis/triggers/v1alpha1/event_listener_types.go#L77-L92
including my verbose comment and TODO around the
ServiceAccount
field.Now, as already indicated in tektoncd/community#148 and the use of a string type
serviceAccountName
, as well in the WG discussion, any SA assoicated with a Trigger should be in the same namespace as the triggerSo why make this correction now vs. just waiting until the TEP is implemented?
@dibyom 's comment #628 (comment) is what motivated me to submit this for consideration.
If the "run CLI tool" item noted there drops with sufficient time before the tep does, then we don't want the precedent of triggers using SAs from other namespaces being established.
Thoughts @khrm @dibyom @dorismeixing ?
Submitter Checklist
These are the criteria that every PR should meet, please check them off as you
review them:
See the contribution guide for more details.
Release Notes