fix/serviceaccount deletion → develop

compute/kubernetes/backend.go

@@ -266,6 +266,16 @@ func (b *Backend) createResources(ctx context.Context, task *tes.Task, config *c
 func (b *Backend) cleanResources(ctx context.Context, taskId string) error {
 	var errs error
 
+	// Check whether this task used an externally-managed ServiceAccount (e.g.
+	// Gen3Workflow per-user SA supplied via _WORKER_SA tag). If so, skip SA
+	// deletion — the SA is shared across tasks and must not be torn down here.
+	externalSA := false
+	if task, err := b.database.GetTask(ctx, &tes.GetTaskRequest{Id: taskId, View: tes.View_FULL.String()}); err == nil {
+		if saName, exists := task.Tags["_WORKER_SA"]; exists && saName != "" {
+			externalSA = true
+		}
+	}
+
 	// Delete Job
 	b.log.Debug("deleting Job", "taskID", taskId)
 	err := resources.DeleteJob(ctx, b.conf, taskId, b.client, b.log)
@@ -303,7 +313,7 @@ func (b *Backend) cleanResources(ctx context.Context, taskId string) error {
 	}
 
 	// Delete ServiceAccount
-	err = resources.DeleteServiceAccount(ctx, taskId, b.conf.Kubernetes.JobsNamespace, b.client, b.log)
+	err = resources.DeleteServiceAccount(ctx, taskId, b.conf.Kubernetes.JobsNamespace, b.client, b.log, externalSA)
 	if err != nil {
 		errs = multierror.Append(errs, err)
 		b.log.Error("deleting Worker ServiceAccount", "error", err)

compute/kubernetes/resources/configmap.go

@@ -1,18 +1,14 @@
 package resources
 
 import (
-	"bytes"
 	"context"
 	"fmt"
-	"strings"
-	"text/template"
 
 	"github.com/ohsu-comp-bio/funnel/config"
 	"github.com/ohsu-comp-bio/funnel/logger"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
-	"k8s.io/client-go/kubernetes/scheme"
 )
 
 func CreateConfigMap(ctx context.Context, taskId string, conf *config.Config, client kubernetes.Interface, log *logger.Logger) error {
@@ -21,41 +17,19 @@ func CreateConfigMap(ctx context.Context, taskId string, conf *config.Config, cl
 		return fmt.Errorf("marshaling config to ConfigMap: %v", err)
 	}
 
-	indentFn := func(spaces int, s string) string {
-		pad := strings.Repeat(" ", spaces)
-		lines := strings.Split(s, "\n")
-		for i, line := range lines {
-			if line != "" {
-				lines[i] = pad + line
-			}
-		}
-		return strings.Join(lines, "\n")
-	}
-
-	t, err := template.New(taskId).Funcs(template.FuncMap{"indent": indentFn}).Parse(conf.Kubernetes.ConfigMapTemplate)
-	if err != nil {
-		return fmt.Errorf("parsing template: %v", err)
-	}
-
-	var buf bytes.Buffer
-	err = t.Execute(&buf, map[string]interface{}{
-		"TaskId":    taskId,
-		"Namespace": conf.Kubernetes.JobsNamespace,
-		"Data":      string(configBytes),
-	})
-	if err != nil {
-		return fmt.Errorf("%v", err)
-	}
-
-	decode := scheme.Codecs.UniversalDeserializer().Decode
-	obj, _, err := decode(buf.Bytes(), nil, nil)
-	if err != nil {
-		return fmt.Errorf("decoding ConfigMap spec: %v", err)
-	}
-
-	cm, ok := obj.(*corev1.ConfigMap)
-	if !ok {
-		return fmt.Errorf("failed to decode ConfigMap spec")
+	// Create the ConfigMap that will contain the Funnel Worker Config (`funnel-worker.yaml`)
+	cm := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("funnel-worker-config-%s", taskId),
+			Namespace: conf.Kubernetes.JobsNamespace,
+			Labels: map[string]string{
+				"app":    "funnel",
+				"taskId": taskId,
+			},
+		},
+		Data: map[string]string{
+			"funnel-worker.yaml": string(configBytes),
+		},
 	}
 
 	_, err = client.CoreV1().ConfigMaps(conf.Kubernetes.JobsNamespace).Create(ctx, cm, metav1.CreateOptions{})

compute/kubernetes/resources/resources_test.go

@@ -283,7 +283,7 @@ func TestDeleteServiceAccount(t *testing.T) {
 		t.Fatalf("Failed to create test ServiceAccount: %v", err)
 	}
 
-	err = DeleteServiceAccount(context.Background(), testTaskID, namespace, fakeClient, l)
+	err = DeleteServiceAccount(context.Background(), testTaskID, namespace, fakeClient, l, false)
 	if err != nil {
 		t.Errorf("DeleteServiceAccount failed: %v", err)
 	}

compute/kubernetes/resources/serviceaccount.go

@@ -69,7 +69,14 @@ func CreateServiceAccount(ctx context.Context, task *tes.Task, conf *config.Conf
 }
 
 // DeleteServiceAccount deletes the ServiceAccount created for a task.
-func DeleteServiceAccount(ctx context.Context, taskID string, namespace string, client kubernetes.Interface, log *logger.Logger) error {
+// If externalSA is true the ServiceAccount is externally managed (e.g. a
+// Gen3Workflow per-user SA supplied via the _WORKER_SA task tag) and must not
+// be deleted by Funnel.
+func DeleteServiceAccount(ctx context.Context, taskID string, namespace string, client kubernetes.Interface, log *logger.Logger, externalSA bool) error {
+	if externalSA {
+		log.Debug("skipping deletion of externally-managed ServiceAccount", "taskID", taskID)
+		return nil
+	}
 	// ServiceAccount names are not available here without config, so we list by label.
 	sas, err := client.CoreV1().ServiceAccounts(namespace).List(ctx, metav1.ListOptions{
 		LabelSelector: fmt.Sprintf("app=funnel,taskId=%s", taskID),