Skip to main content

Service accounts

Supported Configurations
Running the control plane as a container with:

By default, this is disabled.

Sync ServiceAccount resources from the virtual cluster to the host cluster.

This is useful for using AWS IAM roles for service accounts with the virtual cluster. In this scenario, the host cluster is defined as the identity provider to access your OIDC-compatible system, which means you don't have to configure each virtual cluster as a provider. vCluster creates a host cluster ServiceAccount token for your synchronized ServiceAccount from the virtual cluster.

Sync ServiceAccounts from the virtual to host cluster​

sync:
  toHost:
    serviceAccounts:
      enabled: true

Config reference​

serviceAccounts required object ​

ServiceAccounts defines if service accounts created within the virtual cluster should get synced to the host cluster.

enabled required boolean false ​

Enabled defines if this option should be enabled.

patches required object[] ​

Patches patch the resource according to the provided specification.

path required string ​

Path is the path within the patch to target. If the path is not found within the patch, the patch is not applied.

expression required string ​

Expression transforms the value according to the given JavaScript expression.

reverseExpression required string ​

ReverseExpression transforms the value according to the given JavaScript expression.

reference required object ​

Reference treats the path value as a reference to another object and will rewrite it based on the chosen mode automatically. In single-namespace mode this will translate the name to "vxxxxxxxxx" to avoid conflicts with other names, in multi-namespace mode this will not translate the name.

apiVersion required string ​

APIVersion is the apiVersion of the referenced object.

apiVersionPath required string ​

APIVersionPath is optional relative path to use to determine the kind. If APIVersionPath is not found, will fallback to apiVersion.

kind required string ​

Kind is the kind of the referenced object.

kindPath required string ​

KindPath is the optional relative path to use to determine the kind. If KindPath is not found, will fallback to kind.

namePath required string ​

NamePath is the optional relative path to the reference name within the object.

namespacePath required string ​

NamespacePath is the optional relative path to the reference namespace within the object. If omitted or not found, namespacePath equals to the metadata.namespace path of the object.

labels required object ​

Labels treats the path value as a labels selector.