feat: add service accounts for extensions

steadybit · Aug 14, 2023 · e71ebb0 · e71ebb0
1 parent a4eaa19
commit e71ebb0
Show file tree

Hide file tree

Showing 7 changed files with 44 additions and 1 deletion.
diff --git a/charts/steadybit-extension-host/Chart.yaml b/charts/steadybit-extension-host/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: steadybit-extension-host
 description: Steadybit scaffold extension Helm chart for Kubernetes.
-version: 1.0.24
+version: 1.0.25
 appVersion: latest
 home: https://www.steadybit.com/
 icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png

diff --git a/charts/steadybit-extension-host/templates/daemonset.yaml b/charts/steadybit-extension-host/templates/daemonset.yaml
@@ -96,6 +96,7 @@ spec:
         - name: tmp-dir
           emptyDir: { }
           {{- include "extensionlib.deployment.volumes" (list .) | nindent 8 }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
           {{- with .Values.nodeSelector }}
       nodeSelector:
           {{- toYaml . | nindent 8 }}

diff --git a/charts/steadybit-extension-host/templates/serviceaccount.yaml b/charts/steadybit-extension-host/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+  {{- range $key, $value := .Values.extraLabels }}
+    {{ $key }}: {{ $value }}
+  {{- end }}
+automountServiceAccountToken: true
+{{- end }}
diff --git a/charts/steadybit-extension-host/tests/__snapshot__/daemonset_test.yaml.snap b/charts/steadybit-extension-host/tests/__snapshot__/daemonset_test.yaml.snap
@@ -86,6 +86,7 @@ manifest should match snapshot using podAnnotations, podLabels and resources:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -186,6 +187,7 @@ manifest should match snapshot with TLS:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -283,6 +285,7 @@ manifest should match snapshot with different containerPorts:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -383,6 +386,7 @@ manifest should match snapshot with extra env vars:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -478,6 +482,7 @@ manifest should match snapshot with extra labels:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -583,6 +588,7 @@ manifest should match snapshot with mutual TLS:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -690,6 +696,7 @@ manifest should match snapshot with mutual TLS using containerPaths:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -783,6 +790,7 @@ manifest should match snapshot with update strategy:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir
@@ -876,6 +884,7 @@ manifest should match snapshot without TLS:
           dnsPolicy: ClusterFirstWithHostNet
           hostNetwork: true
           hostPID: true
+          serviceAccountName: steadybit-extension-host
           volumes:
             - emptyDir: {}
               name: tmp-dir

diff --git a/charts/steadybit-extension-host/tests/__snapshot__/serviceaccount_test.yaml.snap b/charts/steadybit-extension-host/tests/__snapshot__/serviceaccount_test.yaml.snap
@@ -0,0 +1,9 @@
+manifest should match snapshot:
+  1: |
+    apiVersion: v1
+    automountServiceAccountToken: true
+    kind: ServiceAccount
+    metadata:
+      labels: null
+      name: steadybit-extension-host
+      namespace: NAMESPACE
diff --git a/charts/steadybit-extension-host/tests/serviceaccount_test.yaml b/charts/steadybit-extension-host/tests/serviceaccount_test.yaml
@@ -0,0 +1,6 @@
+templates:
+  - serviceaccount.yaml
+tests:
+  - it: manifest should match snapshot
+    asserts:
+      - matchSnapshot: { }
diff --git a/charts/steadybit-extension-host/values.yaml b/charts/steadybit-extension-host/values.yaml
@@ -59,6 +59,12 @@ updateStrategy:
     # updateStrategy.rollingUpdate.maxSurge -- The maximum number of DaemonSet pods that can be unavailable during the update.
     maxUnavailable: 1
 
+serviceAccount:
+  # serviceAccount.create -- Specifies whether a ServiceAccount should be created.
+  create: true
+  # serviceAccount.name -- The name of the ServiceAccount to use.
+  name: steadybit-extension-host
+
 # extra labels to apply to the Kubernetes resources
 extraLabels: {}