fix(prepuller): Add dummy service accounts to hook-image-puller and continuous-image-puller pods

Author: samyuh

jupyterhub/templates/_helpers-names.tpl

@@ -196,11 +196,29 @@
     {{- include "jupyterhub.fullname.dash" . }}hook-image-puller
 {{- end }}
 
+{{- /* hook-image-puller ServiceAccount */}}
+{{- define "jupyterhub.hook-image-puller-serviceaccount.fullname" -}}
+    {{- if .Values.prePuller.hook.serviceAccountImagePuller.create }}
+        {{- .Values.prePuller.hook.serviceAccountImagePuller.name | default (include "jupyterhub.hook-image-puller.fullname" .) }}
+    {{- else }}
+        {{- .Values.prePuller.hook.serviceAccountImagePuller.name | default "default" }}
+    {{- end }}
+{{- end }}
+
 {{- /* continuous-image-puller DaemonSet */}}
 {{- define "jupyterhub.continuous-image-puller.fullname" -}}
     {{- include "jupyterhub.fullname.dash" . }}continuous-image-puller
 {{- end }}
 
+{{- /* continuous-image-puller ServiceAccount */}}
+{{- define "jupyterhub.continuous-image-puller-serviceaccount.fullname" -}}
+    {{- if .Values.prePuller.continuous.serviceAccount.create }}
+        {{- .Values.prePuller.continuous.serviceAccount.name | default (include "jupyterhub.continuous-image-puller.fullname" .) }}
+    {{- else }}
+        {{- .Values.prePuller.continuous.serviceAccount.name | default "default" }}
+    {{- end }}
+{{- end }}
+
 {{- /* singleuser NetworkPolicy */}}
 {{- define "jupyterhub.singleuser.fullname" -}}
     {{- include "jupyterhub.fullname.dash" . }}singleuser

jupyterhub/templates/image-puller/_helpers-daemonset.tpl

@@ -70,6 +70,15 @@ spec:
               {{- include "jupyterhub.userNodeAffinityRequired" . | nindent 14 }}
       {{- end }}
       terminationGracePeriodSeconds: 0
+      {{- if .hook }}
+      {{- with include "jupyterhub.hook-image-puller-serviceaccount.fullname" . }}
+      serviceAccountName: {{ . }}
+      {{- end }}
+      {{- else }}
+      {{- with include "jupyterhub.continuous-image-puller-serviceaccount.fullname" . }}
+      serviceAccountName: {{ . }}
+      {{- end }}
+      {{- end }}
       automountServiceAccountToken: false
       {{- with include "jupyterhub.imagePullSecrets" (dict "root" . "image" .Values.singleuser.image) }}
       imagePullSecrets: {{ . }}

jupyterhub/templates/image-puller/serviceaccount-continuous.yaml

@@ -0,0 +1,17 @@
+{{- /*
+ServiceAccount for the continuous image-puller daemonset
+*/}}
+{{- if .Values.prePuller.continuous.serviceAccount.create -}}
+{{- if .Values.prePuller.continuous.enabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "jupyterhub.continuous-image-puller.fullname" . }}
+  labels:
+    {{- include "jupyterhub.labels" . | nindent 4 }}
+  annotations:
+    {{- with .Values.prePuller.continuous.serviceAccount.annotations }}
+    {{- . | toYaml | nindent 4 }}
+    {{- end }}
+{{- end }}
+{{- end }}

jupyterhub/templates/image-puller/serviceaccount-hook.yaml

@@ -0,0 +1,21 @@
+{{- /*
+ServiceAccount for the hook image-puller daemonset
+*/}}
+{{- if .Values.prePuller.hook.serviceAccountImagePuller.create -}}
+{{- if (include "jupyterhub.imagePuller.daemonset.hook.install" .) -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "jupyterhub.hook-image-puller-serviceaccount.fullname" . }}
+  labels:
+    {{- include "jupyterhub.labels" . | nindent 4 }}
+    hub.jupyter.org/deletable: "true"
+  annotations:
+    "helm.sh/hook": pre-install,pre-upgrade
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
+    "helm.sh/hook-weight": "0"
+    {{- with .Values.prePuller.hook.serviceAccountImagePuller.annotations }}
+    {{- . | toYaml | nindent 4 }}
+    {{- end }}
+{{- end }}
+{{- end }}

jupyterhub/values.schema.yaml

@@ -2864,6 +2864,7 @@ properties:
           image: *image-spec
           resources: *resources-spec
           serviceAccount: *serviceAccount
+          serviceAccountImagePuller: *serviceAccount
       continuous:
         type: object
         additionalProperties: false
@@ -2880,6 +2881,7 @@ properties:
         properties:
           enabled:
             type: boolean
+          serviceAccount: *serviceAccount
       pullProfileListImages:
         type: boolean
         description: |

jupyterhub/values.yaml

@@ -665,12 +665,22 @@ prePuller:
     nodeSelector: {}
     tolerations: []
     resources: {}
+    # Service Account for the hook-image-awaiter Job
     serviceAccount:
       create: true
       name:
       annotations: {}
+    # Service Account for the hook-image-puller DaemonSet
+    serviceAccountImagePuller:
+      create: true
+      name:
+      annotations: {}
   continuous:
     enabled: true
+    serviceAccount:
+      create: true
+      name:
+      annotations: {}
   pullProfileListImages: true
   extraImages: {}
   pause: