From af611b1e9a16105c29895fbcf58a2dcfa6bbd68a Mon Sep 17 00:00:00 2001 From: Peter Triesz <61414518+trieszklr@users.noreply.github.com> Date: Wed, 1 Jul 2020 22:52:00 +0200 Subject: [PATCH] [stable/prometheus-cloudwatch-exporter] additional docu on service account usage (#23028) * additional info on service account config so one can read mounted secret this worked OK: ``` securityContext: runAsUser: 65534 # run as nobody user instead of root fsGroup: 65534 # to read mounted secret with the same id ``` Signed-off-by: Peter Triesz * updating chart version after readme modification Signed-off-by: Peter Triesz --- stable/prometheus-cloudwatch-exporter/Chart.yaml | 2 +- stable/prometheus-cloudwatch-exporter/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/stable/prometheus-cloudwatch-exporter/Chart.yaml b/stable/prometheus-cloudwatch-exporter/Chart.yaml index 3bc0cce628..f9cb6b9234 100644 --- a/stable/prometheus-cloudwatch-exporter/Chart.yaml +++ b/stable/prometheus-cloudwatch-exporter/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v1 appVersion: "0.8.0" description: A Helm chart for prometheus cloudwatch-exporter name: prometheus-cloudwatch-exporter -version: 0.8.1 +version: 0.8.2 home: https://github.com/prometheus/cloudwatch_exporter sources: - https://github.com/prometheus/cloudwatch_exporter diff --git a/stable/prometheus-cloudwatch-exporter/README.md b/stable/prometheus-cloudwatch-exporter/README.md index 07c43ec22e..ca94d26b3d 100644 --- a/stable/prometheus-cloudwatch-exporter/README.md +++ b/stable/prometheus-cloudwatch-exporter/README.md @@ -15,7 +15,7 @@ This chart bootstraps a [cloudwatch exporter](http://github.com/prometheus/cloud ## Prerequisites - [kube2iam](../../stable/kube2iam) installed to used the **aws.role** config option otherwise configure **aws.aws_access_key_id** and **aws.aws_secret_access_key** or **aws.secret.name** -- Or an [IAM Role for service account](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/) attached to a service account with an annotation. However, you cannot run the pod as nobody in `securityContext.runAsUser` as it won't be able to access the mounted secret. +- Or an [IAM Role for service account](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/) attached to a service account with an annotation. If you run the pod as nobody in `securityContext.runAsUser` then also set `securityContext.fsGroup` to the same value so it will be able to access to the mounted secret. ## Installing the Chart