[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: soltysh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

/triage accepted
/priority backlog

Can we have a :party_parrot: here?

Will review ASAP so this can ship in v1.21

@soltysh just two points of concern here :)

@soltysh just two points of concern here :)

Good point, updated.

/test pull-kubernetes-e2e-kind

Test passed locally, retesting here

/lgtm

Thanks!!

Why was --serviceaccount deprecated for kubectl run? Is the intention really that users have to specify this via a JSON blob instead? (Also: Unlike the message says, it does seem to have an effect for me when I use it)

@soltysh

As described by shartte,

--serviceaccount is still working for me despite the notice about it having no effect.

I'm most concerned because it's described in the current official CKAD Study Guide:

you can use the --serviceaccount flag in conjunction with the run command when creating the Pod:

Example

❮ k run nginx --image=nginx --restart=Never --serviceaccount=custom
Flag --serviceaccount has been deprecated, has no effect and will be removed in the future.
pod/nginx created

❯ k get po nginx -o yaml | rg -i -C 3 serviceaccount               
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: custom-token-ljvxm
      readOnly: true
  dnsPolicy: ClusterFirst
--
  restartPolicy: Never
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: custom
  serviceAccountName: custom

Kubectl version info

❯ k version -o yaml
clientVersion:
  buildDate: "2021-04-08T16:31:21Z"
  compiler: gc
  gitCommit: cb303e613a121a29364f75cc67d3d580833a7479
  gitTreeState: clean
  gitVersion: v1.21.0
  goVersion: go1.16.1
  major: "1"
  minor: "21"
  platform: linux/amd64
serverVersion:
  buildDate: "2021-01-13T13:20:00Z"
  compiler: gc
  gitCommit: faecb196815e248d3ecfb03c680a4507229c2a56
  gitTreeState: clean
  gitVersion: v1.20.2
  goVersion: go1.15.5
  major: "1"
  minor: "20"
  platform: linux/amd64

I'd also like to know why --serviceaccount is being deprecated. It is incredibly useful, and nothing in this PR points to a reason for the deprecation.

The alternative is quite clunky:

--overrides='{ "spec": { "serviceAccount" : "my-service-account" } }'

Same question but for --limits -- the output says it's not being honored, but it is -- how long will that exist in this state, I wonder.

Was the reason for deprecation of --serviceaccount ever provided?

Was the reason for deprecation of --serviceaccount ever provided?

According to bing's GPT:

The --serviceaccount flag along with other generators in the kubectl run command were deprecated due to a couple of reasons1:

Complexity for users: The vast number of input parameters for the kubectl run command was overwhelming for both newcomers and experienced users. It was challenging to predict the result of a command invocation, as it required considering several passed options as well as the server version1.

Maintenance challenges: The code behind the kubectl run command was difficult to maintain due to the growing matrix of possibilities1.

The intention behind this deprecation was to simplify the user experience and make maintenance more manageable. The Kubernetes team wanted to move users away from using kubectl run for their daily workflows and encourage them to use explicit kubectl create commands, which are more straightforward1.

As of a certain update, kubectl run will only create Pods, and all generators will be removed entirely1. This change aligns with the experience of running a container in Docker or any other container engine, where a single command runs a container. In Kubernetes, kubectl run will just run a Pod in a cluster1.