Advanced Clusters

Back Next

Use an Informatica-managed service account (alternative)

If you don't provide the service account name using the property

infa.k8s.spark.custom.service.account.name

, Informatica creates a default service account, cluster role, and cluster role binding.

Informatica creates a service account called

infa-spark

and a cluster role binding called

infa-spark-role

for the Spark driver. This cluster role binding uses the default cluster role edit that's available in Kubernetes clusters. The edit role lets you perform basic actions like deploying Pods. For more information about the edit role, see Kubernetes documentation.

When the Spark shuffle service is enabled, Informatica creates a separate service account, cluster role, and cluster role binding on the cluster. Informatica assigns the following cluster role permissions to the service account:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: spark-shuffle
  labels:
    {{- range $index, $value := .Values.shuffleDsServiceAccountLabels }}
       {{ $index }}: {{ $value }}
    {{- end }}
rules:
- apiGroups: [""]
  resources: ["events","endpoints"]
  verbs: ["create", "patch"]
- apiGroups: [""]
  resources: ["pods/eviction"]
  verbs: ["create"]
- apiGroups: [""]
  resources: ["pods/status"]
  verbs: ["update"]
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["watch","list","get","update", "patch"]
- apiGroups: [""]
  resources: ["pods","services","replicationcontrollers","persistentvolumeclaims","persistentvolumes"]
  verbs: ["watch","list","get"]
- apiGroups: ["apps"]
  resources: ["replicasets","daemonsets"]  
  verbs: ["watch","list","get"]
- apiGroups: ["policy"]
  resources: ["poddisruptionbudgets"]
  verbs: ["watch","list"]
- apiGroups: ["apps"]
  resources: ["statefulsets"]
  verbs: ["watch","list","get"]
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["watch","list","get"]

Rename Saved Search

Table of Contents

Advanced Clusters

Advanced Clusters

Use an Informatica-managed service account (alternative)

Use an Informatica-managed service account (alternative)