serviceAccountName has no effect for pre-packaged implementation

[mlegore]

I have observed that creating a SeldonDeployment with TENSORFLOW_SERVING with the serviceAccountName does not update the resulting pod spec with that service account name, it instead uses the default.

The is what my yaml looks like:

apiVersion: machinelearning.seldon.io/v1alpha2
kind: SeldonDeployment
metadata:
  name: tfserving
spec:
  name: tfserving
  predictors:
  - graph:
      serviceAccountName: kf-user
      children: []
      implementation: TENSORFLOW_SERVER
      modelUri: gs://bucketname/SavedModel/v1
      name: model-tfserving
      parameters:
        - name: signature_name
          type: STRING
          value: pooled_output
        - name: model_name
          type: STRING
          value: model-tfserving
    name: default
    replicas: 1

[ukclivecox]

Ther serviceAccount name is actually used for the model init container for downloading the model from the modelUri.

The preferred method at present of adding a serviceAccount to the pod you want the image to run in is to define the PodSpec yourself.

In theory several prePackaged servers could all be placed in the same podSpec so we could have conflicts of which serviceAccount to use if it also applied to the PodSpec.

We can update our docs.

[ukclivecox]

The docs also discuss the use of serviceAccount: https://docs.seldon.io/projects/seldon-core/en/latest/servers/overview.html#prepackaged-model-servers

Please open a new issue if you have problems specifying the serviceAccount in the podSpec itself.

[mlegore]

I think I misunderstood what seldon was doing in the background. The model failed to load at the download phase, so it seems like the init download container wasn't using the right service account actually, still a bug, I think @cliveseldon