Not able to enable video recording about moon HOT 5 OPEN

@buettner123 actually these capabilities should go under moon:options key. I.e. you create a capability called moon:options and then put a HashMap<String, Object> inside with all capabilities from your example. https://github.com/aerokube/moon-cloud-java-example/blob/master/src/test/java/com/aerokube/moon/MoonCloudExampleTest.java#L25-L31

from moon.

Thanks for the hint @vania-pooh. This helped to get the video recording starting.

However I encountered some AccessDenied issues with the saving to the bucket. I think there might be some missing/incomplete documentation for the serviceAccount stuff.

Looking at the values file for the helm chart, I see that it suggest adding:

configs:
  default:
    serviceAccountName: aerokube-moon
    serviceAccountAnnotations: {...}

However, digging into the helm chart I found out that this is actually supposed to be placed on the quota level and the one on config.default.serviceAccount* level doesn't seem to have any effect.

My values.yml now looks like this:

quota:
  moon: null
  test:
    namespace: moon-test
    password: ''
    serviceAccountName: aerokube-moon
    serviceAccountAnnotations: {
      "eks.amazonaws.com/role-arn": "arn:aws:iam::xxxx:role/MoonIAMRole"
    }

With this changes and by providing the role-arn to the service account, it works fine for my eks+iam roles and service account setup.

Maybe it makes sense to adjust the default values.yml file to reflect this or add some more context to the documentation in https://aerokube.com/moon/latest/#faq-kubernetes-service-account

And for the sake of completeness, I adapted the above IAM policy a bit to feature less actions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "s3:PutObject",
        "s3:ListBucket",
        "s3:GetObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::${TargetBucket}/*",
        "arn:aws:s3:::${TargetBucket}"
      ]
    }
  ]
}

In addition, TargetBucket is replaced with the bucket name on creation of the policy.

from moon.

@buettner123 started fixing this and can't find an exact location where we suggest adding the following:

configs:
  default:
    serviceAccountName: aerokube-moon
    serviceAccountAnnotations: {...}

Only found correct example. Could you please provide some reference?

from moon.

For the serviceAccountName there is https://github.com/aerokube/charts/blob/master/moon2/values.yaml#L350 which seems to have no effect.
The configs.default.serviceAccountAnnotations was an assumption from my side not reflected in the values file (but would make sense in my opinion, if there will be some defaults available)

from moon.

from moon.