Improvements and bug fixes in DM config. #904
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Create a service account to be used to authorize TFJobs and other work within the cluster. * Create a helper script to download service account keys and turn them into K8s keys * Fix some bugs in the docs. * Fix kubeflow#878 create a GCP service account for the user. * IAP script needs a GCP service account with network admin privileges. * Add network admin privileges to the admin service account. * Name the secrets in K8s so that be default the names are the same across the deployments. This way there's one less parameter to set for every deployment. * VM service account should have a unique name per deployment so deployments are isolated. * Need to grant the VM service account logs and monitoring access to support monitoring. * I don't think there's any reason to allow user to specify name of the VM service account in the YAML file right now.
|
/assign @ankushagarwal |
docs/gke/create_k8s_secrets.sh
Outdated
|
|
||
| # TODO(jlewi): We should name the secrets more consistently based on the service account name. | ||
| # We will need to update the component configs though | ||
| gcloud --project=${PROJECT} iam service-accounts keys create ${SA_EMAIL}.json --iam-account $SA_EMAIL |
| @@ -286,9 +300,40 @@ TODO(jlewi): Do we need to serialize API activation | |||
| members: | |||
| - {{ 'serviceAccount:' + env['project_number'] + '@cloudservices.gserviceaccount.com' }} | |||
|
|
|||
| {# servicemanagement.admin is needed by CloudEndpoints controller | |||
There was a problem hiding this comment.
How do we manage deletion of IAM Role Bindings? When we delete the deployment, the service accounts go away but these IAM Role Bindings still lurk around.
There was a problem hiding this comment.
Good point. Created
#910
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ankushagarwal The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/lgtm |
|
/test all |
wmuizelaar
pushed a commit
to bolcom/kubeflow
that referenced
this pull request
Jun 5, 2018
* Improvements and bug fixes in DM config. * Create a service account to be used to authorize TFJobs and other work within the cluster. * Create a helper script to download service account keys and turn them into K8s keys * Fix some bugs in the docs. * Fix kubeflow#878 create a GCP service account for the user. * IAP script needs a GCP service account with network admin privileges. * Add network admin privileges to the admin service account. * Name the secrets in K8s so that be default the names are the same across the deployments. This way there's one less parameter to set for every deployment. * VM service account should have a unique name per deployment so deployments are isolated. * Need to grant the VM service account logs and monitoring access to support monitoring. * I don't think there's any reason to allow user to specify name of the VM service account in the YAML file right now. * Address comments. * Autoformat jsonnet.
saffaalvi
pushed a commit
to StatCan/kubeflow
that referenced
this pull request
Feb 11, 2021
* Improvements and bug fixes in DM config. * Create a service account to be used to authorize TFJobs and other work within the cluster. * Create a helper script to download service account keys and turn them into K8s keys * Fix some bugs in the docs. * Fix kubeflow#878 create a GCP service account for the user. * IAP script needs a GCP service account with network admin privileges. * Add network admin privileges to the admin service account. * Name the secrets in K8s so that be default the names are the same across the deployments. This way there's one less parameter to set for every deployment. * VM service account should have a unique name per deployment so deployments are isolated. * Need to grant the VM service account logs and monitoring access to support monitoring. * I don't think there's any reason to allow user to specify name of the VM service account in the YAML file right now. * Address comments. * Autoformat jsonnet.
yanniszark
pushed a commit
to arrikto/kubeflow
that referenced
this pull request
Feb 15, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Create a service account to be used to authorize TFJobs and other work
within the cluster.
Create a helper script to download service account keys and turn
them into K8s keys
Fix some bugs in the docs.
Fix Deployment manager config should create service accounts and set IAM roles #878 create a GCP service account for the user.
IAP script needs a GCP service account with network admin privileges.
Add network admin privileges to the admin service account.
Name the secrets in K8s so that be default the names are the same across
the deployments. This way there's one less parameter to set for
every deployment.
VM service account should have a unique name per deployment so deployments
are isolated.
Need to grant the VM service account logs and monitoring access to support
monitoring.
I don't think there's any reason to allow user to specify name of the
VM service account in the YAML file right now.
This change is