add missing automount_service_account_token to the pod spec #261

jhoblitt · 2018-12-19T15:01:56Z

The same as #251 with the code formatting issue fixed.

closes #251

alexsomesan · 2018-12-19T15:26:18Z

Thanks. FYI, you can also push commits to the same PR. No need to re-open.

Let me run the acceptance tests on this.

alexsomesan · 2018-12-19T15:27:31Z

Also, I think this new attribute should at least be added to one of the ACC test configurations, to be exercised by the tests.

jhoblitt · 2018-12-19T15:28:24Z

@alexsomesan I can't push to the original PR opener's fork/branch so it had to be a new PR...

jhoblitt · 2018-12-19T15:33:12Z

@alexsomesan I'm a provider n00b. I see a automount_service_account_token test for kubernetes_service_account. Is that a pattern that you'd like copied-ish for resources that use a pod spec or is there a better example you could point me at?

jhoblitt · 2018-12-26T22:12:34Z

@alexsomesan After banging my head against the wall figuring out how to run the acc tests without the framework trying to startup > 1K pods all at once (a testacc README blurb would be greatly appreciated), I've taken a stab at adding a simple acceptance test... which has turned up two obvious problems:

an idempotency issue with the resource trying to remove the service account secret volume
an ordering problem with the service_account type.

The volume will probably require heuristically predicting the name. The later I don't know how to fix and would appreciate any guidance you might have.

$ make testacc TEST=./kubernetes TESTARGS='-run=TestAccKubernetesPod_config_with_automount_service_account_token'
==> Checking that code complies with gofmt requirements...
TF_ACC=1 go test ./kubernetes -v -run=TestAccKubernetesPod_config_with_automount_service_account_token -timeout 120m
=== RUN   TestAccKubernetesPod_config_with_automount_service_account_token
--- FAIL: TestAccKubernetesPod_config_with_automount_service_account_token (7.49s)
	testing.go:518: Step 0 error: After applying this step, the plan was not empty:
		
		DIFF:
		
		DESTROY/CREATE: kubernetes_pod.test
		  metadata.#:                                   "1" => "1"
		  metadata.0.generation:                        "0" => "<computed>"
		  metadata.0.labels.%:                          "1" => "1"
		  metadata.0.labels.app:                        "pod_label" => "pod_label"
		  metadata.0.name:                              "tf-acc-test-jnsnythdb6" => "tf-acc-test-jnsnythdb6"
		  metadata.0.namespace:                         "default" => "default"
		  metadata.0.resource_version:                  "12968" => "<computed>"
		  metadata.0.self_link:                         "/api/v1/namespaces/default/pods/tf-acc-test-jnsnythdb6" => "<computed>"
		  metadata.0.uid:                               "c7fdcebb-0954-11e9-bbed-42010a8001e6" => "<computed>"
		  spec.#:                                       "1" => "1"
		  spec.0.automount_service_account_token:       "true" => "true"
		  spec.0.container.#:                           "1" => "1"
		  spec.0.container.0.image:                     "nginx:1.7.9" => "nginx:1.7.9"
		  spec.0.container.0.image_pull_policy:         "IfNotPresent" => "<computed>"
		  spec.0.container.0.name:                      "containername" => "containername"
		  spec.0.container.0.resources.#:               "1" => "<computed>"
		  spec.0.container.0.stdin:                     "false" => "false"
		  spec.0.container.0.stdin_once:                "false" => "false"
		  spec.0.container.0.termination_message_path:  "/dev/termination-log" => "/dev/termination-log"
		  spec.0.container.0.tty:                       "false" => "false"
		  spec.0.container.0.volume_mount.#:            "1" => "0" (forces new resource)
		  spec.0.container.0.volume_mount.0.mount_path: "/var/run/secrets/kubernetes.io/serviceaccount" => ""
		  spec.0.container.0.volume_mount.0.name:       "tf-acc-test-bnq812kuef-token-zjwwn" => ""
		  spec.0.container.0.volume_mount.0.read_only:  "true" => "false"
		  spec.0.dns_policy:                            "ClusterFirst" => "ClusterFirst"
		  spec.0.host_ipc:                              "false" => "false"
		  spec.0.host_network:                          "false" => "false"
		  spec.0.host_pid:                              "false" => "false"
		  spec.0.hostname:                              "" => "<computed>"
		  spec.0.image_pull_secrets.#:                  "0" => "<computed>"
		  spec.0.node_name:                             "gke-jhoblitt-test-tf-pro-default-pool-75cefd47-v6f8" => "<computed>"
		  spec.0.restart_policy:                        "Always" => "Always"
		  spec.0.service_account_name:                  "tf-acc-test-bnq812kuef" => "tf-acc-test-bnq812kuef"
		  spec.0.termination_grace_period_seconds:      "30" => "30"
		  spec.0.volume.#:                              "1" => "0" (forces new resource)
		  spec.0.volume.0.name:                         "tf-acc-test-bnq812kuef-token-zjwwn" => ""
		  spec.0.volume.0.secret.#:                     "1" => "0"
		  spec.0.volume.0.secret.0.secret_name:         "tf-acc-test-bnq812kuef-token-zjwwn" => ""
		
		STATE:
		
		kubernetes_pod.test:
		  ID = default/tf-acc-test-jnsnythdb6
		  provider = provider.kubernetes
		  metadata.# = 1
		  metadata.0.annotations.% = 0
		  metadata.0.generate_name = 
		  metadata.0.generation = 0
		  metadata.0.labels.% = 1
		  metadata.0.labels.app = pod_label
		  metadata.0.name = tf-acc-test-jnsnythdb6
		  metadata.0.namespace = default
		  metadata.0.resource_version = 12968
		  metadata.0.self_link = /api/v1/namespaces/default/pods/tf-acc-test-jnsnythdb6
		  metadata.0.uid = c7fdcebb-0954-11e9-bbed-42010a8001e6
		  spec.# = 1
		  spec.0.active_deadline_seconds = 0
		  spec.0.automount_service_account_token = true
		  spec.0.container.# = 1
		  spec.0.container.0.args.# = 0
		  spec.0.container.0.command.# = 0
		  spec.0.container.0.env.# = 0
		  spec.0.container.0.env_from.# = 0
		  spec.0.container.0.image = nginx:1.7.9
		  spec.0.container.0.image_pull_policy = IfNotPresent
		  spec.0.container.0.lifecycle.# = 0
		  spec.0.container.0.liveness_probe.# = 0
		  spec.0.container.0.name = containername
		  spec.0.container.0.port.# = 0
		  spec.0.container.0.readiness_probe.# = 0
		  spec.0.container.0.resources.# = 1
		  spec.0.container.0.resources.0.limits.# = 0
		  spec.0.container.0.resources.0.requests.# = 1
		  spec.0.container.0.resources.0.requests.0.cpu = 100m
		  spec.0.container.0.resources.0.requests.0.memory = 
		  spec.0.container.0.security_context.# = 0
		  spec.0.container.0.stdin = false
		  spec.0.container.0.stdin_once = false
		  spec.0.container.0.termination_message_path = /dev/termination-log
		  spec.0.container.0.tty = false
		  spec.0.container.0.volume_mount.# = 1
		  spec.0.container.0.volume_mount.0.mount_path = /var/run/secrets/kubernetes.io/serviceaccount
		  spec.0.container.0.volume_mount.0.name = tf-acc-test-bnq812kuef-token-zjwwn
		  spec.0.container.0.volume_mount.0.read_only = true
		  spec.0.container.0.volume_mount.0.sub_path = 
		  spec.0.container.0.working_dir = 
		  spec.0.dns_policy = ClusterFirst
		  spec.0.host_ipc = false
		  spec.0.host_network = false
		  spec.0.host_pid = false
		  spec.0.hostname = 
		  spec.0.image_pull_secrets.# = 0
		  spec.0.init_container.# = 0
		  spec.0.node_name = gke-jhoblitt-test-tf-pro-default-pool-75cefd47-v6f8
		  spec.0.node_selector.% = 0
		  spec.0.restart_policy = Always
		  spec.0.security_context.# = 0
		  spec.0.service_account_name = tf-acc-test-bnq812kuef
		  spec.0.subdomain = 
		  spec.0.termination_grace_period_seconds = 30
		  spec.0.volume.# = 1
		  spec.0.volume.0.aws_elastic_block_store.# = 0
		  spec.0.volume.0.azure_disk.# = 0
		  spec.0.volume.0.azure_file.# = 0
		  spec.0.volume.0.ceph_fs.# = 0
		  spec.0.volume.0.cinder.# = 0
		  spec.0.volume.0.config_map.# = 0
		  spec.0.volume.0.downward_api.# = 0
		  spec.0.volume.0.empty_dir.# = 0
		  spec.0.volume.0.fc.# = 0
		  spec.0.volume.0.flex_volume.# = 0
		  spec.0.volume.0.flocker.# = 0
		  spec.0.volume.0.gce_persistent_disk.# = 0
		  spec.0.volume.0.git_repo.# = 0
		  spec.0.volume.0.glusterfs.# = 0
		  spec.0.volume.0.host_path.# = 0
		  spec.0.volume.0.iscsi.# = 0
		  spec.0.volume.0.name = tf-acc-test-bnq812kuef-token-zjwwn
		  spec.0.volume.0.nfs.# = 0
		  spec.0.volume.0.persistent_volume_claim.# = 0
		  spec.0.volume.0.photon_persistent_disk.# = 0
		  spec.0.volume.0.quobyte.# = 0
		  spec.0.volume.0.rbd.# = 0
		  spec.0.volume.0.secret.# = 1
		  spec.0.volume.0.secret.0.default_mode = 420
		  spec.0.volume.0.secret.0.items.# = 0
		  spec.0.volume.0.secret.0.optional = false
		  spec.0.volume.0.secret.0.secret_name = tf-acc-test-bnq812kuef-token-zjwwn
		  spec.0.volume.0.vsphere_volume.# = 0
		
		  Dependencies:
		    kubernetes_service_account.test
		kubernetes_service_account.test:
		  ID = default/tf-acc-test-bnq812kuef
		  provider = provider.kubernetes
		  automount_service_account_token = false
		  default_secret_name = tf-acc-test-bnq812kuef-token-zjwwn
		  image_pull_secret.# = 0
		  metadata.# = 1
		  metadata.0.annotations.% = 0
		  metadata.0.generate_name = 
		  metadata.0.generation = 0
		  metadata.0.labels.% = 0
		  metadata.0.name = tf-acc-test-bnq812kuef
		  metadata.0.namespace = default
		  metadata.0.resource_version = 12954
		  metadata.0.self_link = /api/v1/namespaces/default/serviceaccounts/tf-acc-test-bnq812kuef
		  metadata.0.uid = c7d0a07a-0954-11e9-bbed-42010a8001e6
		  secret.# = 0
FAIL
FAIL	github.com/terraform-providers/terraform-provider-kubernetes/kubernetes7.526s
make: *** [GNUmakefile:17: testacc] Error 1

jhoblitt · 2019-01-10T15:55:19Z

I've removed the depends_on and use of template to make the acc test more consistent with the existing tests.

uschtwill · 2019-01-15T23:21:55Z

We actually fell on our face because of the (unchangable) default on this. Would very much like to see this merged. :)

MarvelOrange · 2019-01-24T09:42:49Z

How we looking for this? I need the attribute to be optional to release 0.1.1 of my shared module that deploys the K8 dashboard. https://github.com/MarvelOrange/terraform-kubernetes-dashboard

pdecat · 2019-02-01T16:08:16Z

I've taken a stab at adding a simple acceptance test... which has turned up two obvious problems:
* an idempotency issue with the resource trying to remove the service account secret volume

* an ordering problem with the service_account type.
The volume will probably require heuristically predicting the name. The later I don't know how to fix and would appreciate any guidance you might have.

I reckon that's what Radek meant in his comments when he said he wanted to avoid spurious diffs:

kubernetes/structures_pod.go

StephenWithPH · 2019-04-10T21:30:36Z

Adding a workaround for those that are (also) stubbing their toes on this...

resource "kubernetes_service_account" "workaround" {
  metadata {
    name      = "workaround"
  }

  automount_service_account_token = "true"
}

Provided you provision the service account with automount_service_account_token = "true", pods which use this service account will have the token auto mounted. This removes the need to specify that value on the pod.

See the service account docs compared to the pod docs.

pdecat · 2019-04-10T21:35:23Z

Indeed, that's what I used yesterday as a work-around too!

Worth noting is that updating that attribute on an existing service account does not yet work, but will in the next release, cf. #377 (comment)

jpreese · 2019-04-11T20:22:36Z

@StephenWithPH I'm not quite sure I understand. The documentation says that the flag can be overridden at the Pod level. The problem is that Pods are hard coded to be false. So even if the ServiceAccount is associated with the Pod, wouldn't the hardcoded false value override it?

Regardless, I'm super excited for this to get merged in.

jhoblitt · 2019-04-11T20:33:16Z

I don't believe this PR isn't in a mergable state as the provider tries to remove secret volume that gets mounted.

jhoblitt · 2019-04-12T00:18:26Z

To add a bit more detail, the provider needs to be taught to ignore the volume that is auto-magically mounted at /var/run/secrets/kubernetes.io/serviceaccount. I am willing to try to implement this but I'm not sure how to go about it. Does anyone have design advise or know of an existing provider that implements this pattern I could use as a reference?

jgwmaxwell · 2019-04-17T15:28:00Z

@jhoblitt am I right in thinking that the ignoring is only required for Pod and not for Deployment or ReplicationController that use templating? If so, maybe this could be split into 2 PRs - one that's ready to go that targets the higher-level constructs, and then another that deals with the issues surrounding Pod state?

Also, if I'm not mistaken, DaemonSet suffers from the same disease too, and would fit into the simpler category to fix.

StephenWithPH · 2019-04-17T15:44:55Z

the provider needs to be taught to ignore the volume that is auto-magically mounted

@jhoblitt ... here is some information that may be useful. I happened to get bitten by this in a very different context. It sounds like you may see the same thing. If so, it's really a larger question for terraform-provider-kubernetes.

kubectl (as a K8s client) does some fairly sophisticated things to assure that it will ...

apply the changes you’ve made, without overwriting any automated changes to properties you haven’t specified

https://github.com/kubernetes/kubernetes/pull/44121/files#diff-9ce7ea8441086bf1902b4f936f4601d0R40097 and https://github.com/kubernetes/kubernetes/pull/44121/files#diff-9ce7ea8441086bf1902b4f936f4601d0R37920 show annotations on k8s' OpenAPI spec (this is the easiest place I could find to link to) which indicate that volumes and volume mounts need to be patch merged.

I believe this is why the automagically-mounted secret volume is tripping you up.

I'm not savvy enough with Terraform plugins to quickly grok whether this plugin already tries to handle "upsert-ish" behavior... especially because that seems like it might conflict with Terraform's declarative design goals.

alexpekurovsky · 2019-05-01T23:24:23Z

Due to the fact I spent several hours reading issues like this one, I want to share workaround that works today. Instead of trusting pod to mount secret automatically, you need just to set in pod's spec it needs to mount it:

resource "kubernetes_service_account" "kubernetes_dashboard" {
    metadata {
        name      = "kubernetes-dashboard"
        namespace = "kube-system"

        labels {
            k8s-app = "kubernetes-dashboard"
        }
    }
}

resource "kubernetes_deployment" "kubernetes_dashboard" {
    ...
    spec {
        ...
        template {
            ...
            spec {
                volume {
                    name = "${kubernetes_service_account.kubernetes_dashboard.default_secret_name}"
                    secret {
                        secret_name = "${kubernetes_service_account.kubernetes_dashboard.default_secret_name}"
                    }
                }
                ...
                container {
                    ...
                    volume_mount {
                        name       = "${kubernetes_service_account.kubernetes_dashboard.default_secret_name}"
                        mount_path = "/var/run/secrets/kubernetes.io/serviceaccount"
                        read_only  = true
                    }
                }
            }
        }
    }
}

bkarakashev · 2019-05-14T09:20:03Z

Why this is not been merged yet?

jhoblitt · 2019-06-12T19:31:30Z

I'm happy to do what work is needed to get this merged but need guidance...

alexsomesan · 2019-06-12T21:56:49Z

@jhoblitt I've done the rebase, but haven't pushed yet. I'm changing the tests slightly so they don't run into race conditions with the volume mounting. Once the tests are stable we can merge. It's faster if I do it because I need to try out a few different approaches. I'm aiming to include this in the next release.

alexsomesan · 2019-06-15T21:19:40Z

So, solving the problem with the volume showing up in Pod's diff isn't quite trivial, without making some unsubstantiated assumptions about the names of the volume and service account.

While we find a way to reliably filter out the automounted token volume from Pods, I propose we move forward with the fix only for Deployments, DaemonSets and the rest of the managed workload resources, while we leave Pods as they are for now. I expect this to have less disruptive impact while solving this issue for the majority of folks.

Please +1 the comment if you think this will work well for your use case.

This change propagates to the replication_controller, services and deployments. See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#pod-v1-core

…e_account_token

`automountServiceAccountToken` does not appear to a default value per - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#pod-v1-core - https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.13/#pod-v1-core - manual inspection of running pods on a k8s 1.11.5 cluster

…r Deployment

…late spec. Fix style on expansion of 'automount_service_account_token'.

…sources.

alexsomesan

Looks good IMO. CI passes.

davisford · 2019-07-18T23:38:27Z

Adding a workaround for those that are (also) stubbing their toes on this...
resource "kubernetes_service_account" "workaround" {
  metadata {
    name      = "workaround"
  }

  automount_service_account_token = "true"
}
Provided you provision the service account with automount_service_account_token = "true", pods which use this service account will have the token auto mounted. This removes the need to specify that value on the pod.

See the service account docs compared to the pod docs.

I cannot get this to work with

$ terraform version
Terraform v0.12.5
+ provider.k8sraw v0.2.0
+ provider.kubernetes v1.8.0
+ provider.null v2.1.2
+ provider.template v2.1.2

resource "kubernetes_service_account" "operator" {
  metadata {
    name = "zalando-postgres-operator"
    namespace = "default"
  }

  # workaround for https://github.com/terraform-providers/terraform-provider-kubernetes/pull/261#issuecomment-481872856
  automount_service_account_token = true
}

When I spawn an operator that needs the service account it still fails. It is still spec'd with automountServiceAccountToken: false

spec:
  automountServiceAccountToken: false
  containers:
  serviceAccount: zalando-postgres-operator
  serviceAccountName: zalando-postgres-operator

I have to manually add the volume/volume mount to make it work:

      spec {

        service_account_name = kubernetes_service_account.operator.metadata.0.name

        volume {
          name = "service-account-token"
          secret {
            secret_name = kubernetes_service_account.operator.default_secret_name
          }
        }


          volume_mount {
            mount_path = "/var/run/secrets/kubernetes.io/serviceaccount"
            name = "service-account-token"
            read_only = true
          }

This isn't working b/c the operator pod itself spawns additional pods from a CRD. Those pods seem to also inherit the automountServiceAccountToken: false when they get spawned from the operator, and I cannot figure out how to fix.

Should I be using the master branch or a commit past release v1.8.0?

EDIT -- ok, it does work when the operator spawns new pods -- those pods are now auto-mounting the service token. The operator itself, however, still appears to need to manually mount the volume in the deployment spec.

sl1pm4t · 2019-10-03T20:35:22Z

kubernetes/resource_kubernetes_pod.go

+	// Setting this default to false prevents a perpetual diff caused by volume_mounts
+	// being mutated on the server side as Kubernetes automatically adds a mount
+	// for the service account token
+	podSpecFields["automount_service_account_token"].Default = false


FWIW - I resolved this issue in my fork of the provider:
sl1pm4t@e0e953c#diff-7424630baa3c87d787d88925b5f81cac

ghost added the size/XS label Dec 19, 2018

jhoblitt mentioned this pull request Dec 19, 2018

add missing automount_service_account_token to the pod spec #251

Closed

ghost added size/M and removed size/XS labels Dec 26, 2018

jhoblitt force-pushed the pod-spec-automount-service-account-token branch from b2a338f to 9203ad7 Compare December 26, 2018 22:03

kzap mentioned this pull request Jan 7, 2019

automountServiceAccountToken default disagrees with k8s #263

Closed

jhoblitt force-pushed the pod-spec-automount-service-account-token branch from 9203ad7 to 1e1fcdc Compare January 10, 2019 15:49

alexsomesan reviewed Mar 27, 2019

View reviewed changes

kubernetes/structures_pod.go Outdated Show resolved Hide resolved

alexsomesan added the waiting-response label Apr 3, 2019

ghost removed the waiting-response label Apr 10, 2019

jhoblitt force-pushed the pod-spec-automount-service-account-token branch 2 times, most recently from f2404cb to 2eb3ea8 Compare April 11, 2019 20:38

cawilliamson mentioned this pull request Jun 18, 2019

[AWS EKS] invalid configuration: no configuration has been provided kubernetes-sigs/external-dns#1071

Closed

alexsomesan mentioned this pull request Jun 24, 2019

Automountsa #513

Closed

alexsomesan force-pushed the pod-spec-automount-service-account-token branch from 2eb3ea8 to 4a9b79c Compare June 26, 2019 22:55

ghost added size/L documentation and removed size/M labels Jun 27, 2019

zimbatm and others added 10 commits June 28, 2019 00:24

add missing automount_service_account_token to the pod spec

9384b83

This change propagates to the replication_controller, services and deployments. See https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#pod-v1-core

go fmt

c0f143f

fix automount_service_account_token assignment; bool not *bool

03e3430

add TestAccKubernetesPod_config_with_automount_service_account_token

339fbfa

rnd-ify sa name for TestAccKubernetesPod_config_with_automount_servic…

5d311c8

…e_account_token

Enhance 'automount_service_account_token' test for Pod and add one fo…

c6fea19

…r Deployment

Mark 'volume_mount' and 'volume' as Computed in Pod spec and Pod temp…

5976a25

…late spec. Fix style on expansion of 'automount_service_account_token'.

Default automount_service_account_token to false for Pods.

c620e5b

Document 'automount_service_account_token' in Pod and Pot template re…

2ccb673

…sources.

alexsomesan force-pushed the pod-spec-automount-service-account-token branch from cdf0ec8 to 2ccb673 Compare June 27, 2019 22:24

tdmalone mentioned this pull request Jun 28, 2019

Do not hardcode AutomountServiceAccountToken #38

Closed

alexsomesan approved these changes Jun 28, 2019

View reviewed changes

alexsomesan merged commit 25de201 into hashicorp:master Jun 28, 2019

tdmalone mentioned this pull request Jul 4, 2019

automountServiceAccountToken for pods / deployments is neither tracked nor respected #424

Closed

davisford mentioned this pull request Jul 22, 2019

could not create statefulset: statefulsets.apps is forbidden zalando/postgres-operator#624

Closed

loesak mentioned this pull request Aug 16, 2019

Cannot replicate known working Kubernetes configuration YAML file #593

Closed

sl1pm4t mentioned this pull request Sep 5, 2019

Converting official kured 1.2 yaml spec results in daemonset that crash loops sl1pm4t/k2tf#35

Closed

sl1pm4t reviewed Oct 3, 2019

View reviewed changes

ghost locked and limited conversation to collaborators Apr 21, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add missing automount_service_account_token to the pod spec #261

add missing automount_service_account_token to the pod spec #261

jhoblitt commented Dec 19, 2018

alexsomesan commented Dec 19, 2018

alexsomesan commented Dec 19, 2018

jhoblitt commented Dec 19, 2018

jhoblitt commented Dec 19, 2018

jhoblitt commented Dec 26, 2018

jhoblitt commented Jan 10, 2019

uschtwill commented Jan 15, 2019 •

edited

Loading

MarvelOrange commented Jan 24, 2019

pdecat commented Feb 1, 2019

StephenWithPH commented Apr 10, 2019

pdecat commented Apr 10, 2019

jpreese commented Apr 11, 2019

jhoblitt commented Apr 11, 2019

jhoblitt commented Apr 12, 2019 •

edited

Loading

jgwmaxwell commented Apr 17, 2019

StephenWithPH commented Apr 17, 2019

alexpekurovsky commented May 1, 2019 •

edited

Loading

bkarakashev commented May 14, 2019

jhoblitt commented Jun 12, 2019

alexsomesan commented Jun 12, 2019

alexsomesan commented Jun 15, 2019 •

edited

Loading

alexsomesan left a comment

davisford commented Jul 18, 2019 •

edited

Loading

sl1pm4t Oct 3, 2019

add missing automount_service_account_token to the pod spec #261

add missing automount_service_account_token to the pod spec #261

Conversation

jhoblitt commented Dec 19, 2018

alexsomesan commented Dec 19, 2018

alexsomesan commented Dec 19, 2018

jhoblitt commented Dec 19, 2018

jhoblitt commented Dec 19, 2018

jhoblitt commented Dec 26, 2018

jhoblitt commented Jan 10, 2019

uschtwill commented Jan 15, 2019 • edited Loading

MarvelOrange commented Jan 24, 2019

pdecat commented Feb 1, 2019

StephenWithPH commented Apr 10, 2019

pdecat commented Apr 10, 2019

jpreese commented Apr 11, 2019

jhoblitt commented Apr 11, 2019

jhoblitt commented Apr 12, 2019 • edited Loading

jgwmaxwell commented Apr 17, 2019

StephenWithPH commented Apr 17, 2019

alexpekurovsky commented May 1, 2019 • edited Loading

bkarakashev commented May 14, 2019

jhoblitt commented Jun 12, 2019

alexsomesan commented Jun 12, 2019

alexsomesan commented Jun 15, 2019 • edited Loading

alexsomesan left a comment

Choose a reason for hiding this comment

davisford commented Jul 18, 2019 • edited Loading

sl1pm4t Oct 3, 2019

Choose a reason for hiding this comment

uschtwill commented Jan 15, 2019 •

edited

Loading

jhoblitt commented Apr 12, 2019 •

edited

Loading

alexpekurovsky commented May 1, 2019 •

edited

Loading

alexsomesan commented Jun 15, 2019 •

edited

Loading

davisford commented Jul 18, 2019 •

edited

Loading