ansible/awx-operator

Feature request: Ability to add custom labels to EE pods

Open

#242 opened on Apr 23, 2021

View on GitHub
 (8 comments) (2 reactions) (0 assignees)Jinja (712 forks)auto 404
help wantedtype:enhancement

Repository metrics

Stars
 (1,488 stars)
PR merge metrics
 (PR metrics pending)

Description

I am attempting to use AAD Pod Identity to grant my AWX environment implicit access to Azure Key Vault using a user-assigned Managed Identity. One of the requirements is that the pods be labeled with the name of the Managed Identity to use, like this:

apiVersion: v1
kind: Pod
metadata:
  name: demo
  labels:
    aadpodidbinding: <MANAGED_IDENTITY_NAME>

The process works as expected, and I was able to validate by performing kubectl label pod awx-pod aadpodidbinding=MANAGED_IDENTITY_NAME, but AWX generates a new pod for each job. This prevents the authentication from working unless the EE pods can be created by the operator with that label.

I understand that there are already variables that set pod labels for use in node selection, and we already have variables that control annotations for ingress resource definitions. My question is, can there be another AWX spec variable added to set custom labels on EE pods? I know that my ask is specifically about AAD pod identity, but I'm sure there are other use cases for user-defined pod labels.

Contributor guide