Add EnableServiceAccountTokenInjection to CRD

dominodatalab · Jun 22, 2023 · a704e39 · a704e39
1 parent aff099e
commit a704e39
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 1 deletion.
diff --git a/deployments/crds/hephaestus.dominodatalab.com_imagebuilds.yaml b/deployments/crds/hephaestus.dominodatalab.com_imagebuilds.yaml
@@ -78,6 +78,11 @@ spec:
                 description: DisableCacheLayerExport will remove the "inline" cache
                   metadata from the image configuration.
                 type: boolean
+              enableServiceAccountTokenInjection:
+                description: EnableServiceAccountTokenInjection adds a service account
+                  JWT token as build-arg to the images. This supports use cases like
+                  model building that must access other Domino services
+                type: boolean
               images:
                 description: Images is a list of images to build and push.
                 items:

diff --git a/pkg/api/hephaestus/v1/imagebuild_types.go b/pkg/api/hephaestus/v1/imagebuild_types.go
@@ -32,6 +32,9 @@ type ImageBuildSpec struct {
 	DisableLocalBuildCache bool `json:"disableBuildCache,omitempty"`
 	// DisableCacheLayerExport will remove the "inline" cache metadata from the image configuration.
 	DisableCacheLayerExport bool `json:"disableCacheExport,omitempty"`
+	// EnableServiceAccountTokenInjection adds a service account JWT token as build-arg to the images.
+	// This supports use cases like model building that must access other Domino services
+	EnableServiceAccountTokenInjection bool `json:"enableServiceAccountTokenInjection,omitempty"`
 }
 
 type ImageBuildTransition struct {

diff --git a/pkg/controller/imagebuild/component/builddispatcher.go b/pkg/controller/imagebuild/component/builddispatcher.go
@@ -184,7 +184,7 @@ func (c *BuildDispatcherComponent) Reconcile(ctx *core.Context) (ctrl.Result, er
 		return ctrl.Result{}, c.phase.SetFailed(ctx, obj, err)
 	}
 
-	if c.keycloakCfg.Enabled {
+	if obj.Spec.EnableServiceAccountTokenInjection && c.keycloakCfg.Enabled {
 		buildLog.Info("Acquiring Keycloak service account token")
 		kc := gocloak.NewClient(c.keycloakCfg.Server)
 		jwt, err := kc.LoginClient(buildCtx, c.keycloakCfg.ClientID, c.keycloakCfg.ClientSecret, c.keycloakCfg.Realm)