Deploy package form: service account selection should be optional

[gfichtenholt]

Filing bug per @antgamdia request. When installing a flux package I am forced to select a service account in the dashboard ? service account name is optional on the backend, why is the UI forcing me to pick one?

[absoludity]

Flux needs some credential with which to install...I believe ServiceAccountName is optional in the Flux backend because you can instead specify the KubeConfig, or run flux with the --default-service-account flag when installing flux itself (see the doc comment for the KubeConfig flag on the same page Greg linked to, which says: "If the --default-service-account flag is set, its value will be used as a controller level fallback for when HelmReleaseSpec.ServiceAccountName is empty.").

I'm not 100%, but I'd think that if you run flux without the --default-service-account flag then an install without the ServiceAccountName (and without a KubeConfig which we explicitly don't use) will fail? ie. it's a required option if running flux without that flag.

If that's true, then I think either:

• we cater for the case where people may run flux with a --default-service-account set and so only make the ServiceAccountName field optional if we determine flux is running with --default-service-account set, or
• we leave it required so that, like other plugins, users must provide the credentials with which an install is carried out (whether it's their own as in the Helm plugin or a service account as with the carvel plugin).

I don't know that just making it optional is going to be a good user experience, unless I'm missing something.

[gfichtenholt]

Disagree. Maybe flux does need some account down deep but not at the point of my interaction with it (creating/editing a HelmRelease CR). Whatever the default behavior is, at the end of the day I am able to deploy 99.99999% of my flux HelmRelease CRs without having to specify the service account. Most of the time I just don't care/want to worry about it. In the one case that I do care, I will look into the spec and see what's what. I would like the same experience from UX.

[absoludity]

Yep - my mistake. It looks like Flux uses a cluster-admin role when reconciling by default, which is why you never have to worry about it - as long as you can create a HelmRelease CR, flux reconciles it for you using a cluster-admin role (even if you would not have been able to create the reconciled resources yourself). The --default-service-account option is new because people realised that without it flux doesn't easily support a multi-tenant cluster, as anyone who can create a HelmRelease in (only) one namespace, basically has cluster-admin (or can get it quite easily).

But that's the way Helm is today - so of course +1 to use the same UX :)