Skip to content

Commit 7d495fb

Browse files
aslafy-zaslafy-z
authored
feat: allow usage of existing service account
1 parent 2c97270 commit 7d495fb

File tree

10 files changed

+112
-23
lines changed

10 files changed

+112
-23
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ helm delete --namespace test my-application
214214
| Key | Type | Default | Description |
215215
|-----|------|---------|-------------|
216216
| rbac.enabled | bool | `true` | Enable RBAC. |
217+
| rbac.existingServiceAccountName | string | `""` | Existing Service Account Name. |
217218
| rbac.serviceAccount.enabled | bool | `false` | Deploy Service Account. |
218219
| rbac.serviceAccount.name | string | `{{ include "application.name" $ }}` | Service Account Name. |
219220
| rbac.serviceAccount.additionalLabels | object | `nil` | Additional labels for Service Account. |

‎application/templates/_helpers.tpl‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,3 +68,18 @@ reference:
6868
kind: Route
6969
name: {{ include "application.name" . }}
7070
{{- end }}
71+
72+
{{- define "application.service-account-name" }}
73+
{{- if .Values.rbac.enabled }}
74+
{{- if and .Values.rbac.serviceAccount.enabled .Values.rbac.existingServiceAccountName }}
75+
{{- fail "Conflict: 'rbac.existingServiceAccountName' is set, but a new service account is being created. Please disable 'rbac.serviceAccount.enabled' or unset 'rbac.existingServiceAccountName'." }}
76+
{{- end }}
77+
{{- if .Values.rbac.serviceAccount.enabled }}
78+
{{- default (include "application.name" .) .Values.rbac.serviceAccount.name }}
79+
{{- else }}
80+
{{- default "null" .Values.rbac.existingServiceAccountName }}
81+
{{- end }}
82+
{{- else }}
83+
null
84+
{{- end }}
85+
{{- end }}

‎application/templates/cronjob.yaml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -54,13 +54,7 @@ spec:
5454
annotations: {{ toYaml . | nindent 12 }}
5555
{{- end }}
5656
spec:
57-
{{- if $.Values.rbac.enabled }}
58-
{{- if $.Values.rbac.serviceAccount.name }}
59-
serviceAccountName: {{ $.Values.rbac.serviceAccount.name }}
60-
{{- else }}
61-
serviceAccountName: {{ template "application.name" $ }}
62-
{{- end }}
63-
{{- end }}
57+
serviceAccountName: {{ template "application.service-account-name" $ }}
6458
containers:
6559
- name: {{ $name }}
6660
{{- $image := required (print "Undefined image repo for container '" $name "'") $job.image.repository }}

‎application/templates/deployment.yaml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,7 @@ spec:
7474
]
7575
{{- end }}
7676
spec:
77+
serviceAccountName: {{ template "application.service-account-name" $ }}
7778
{{- if .Values.deployment.hostAliases }}
7879
hostAliases:
7980
{{ toYaml .Values.deployment.hostAliases | indent 6 }}
@@ -308,13 +309,6 @@ spec:
308309
{{- end }}
309310
{{- end }}
310311
{{- end }}
311-
{{- if .Values.rbac.serviceAccount.enabled }}
312-
{{- if .Values.rbac.serviceAccount.name }}
313-
serviceAccountName: {{ .Values.rbac.serviceAccount.name }}
314-
{{- else }}
315-
serviceAccountName: {{ template "application.name" $ }}
316-
{{- end }}
317-
{{- end }}
318312
{{- if .Values.deployment.hostNetwork }}
319313
hostNetwork: {{ .Values.deployment.hostNetwork }}
320314
{{- end }}

‎application/templates/job.yaml‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,7 @@ spec:
3737
annotations: {{ toYaml . | nindent 8 }}
3838
{{- end }}
3939
spec:
40-
{{- if $.Values.rbac.enabled }}
41-
{{- if $.Values.rbac.serviceAccount.name }}
42-
serviceAccountName: {{ $.Values.rbac.serviceAccount.name }}
43-
{{- else }}
44-
serviceAccountName: {{ template "application.name" $ }}
45-
{{- end }}
46-
{{- end }}
40+
serviceAccountName: {{ template "application.service-account-name" $ }}
4741
containers:
4842
- name: {{ $name }}
4943

‎application/templates/serviceaccount.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
apiVersion: v1
44
kind: ServiceAccount
55
metadata:
6-
name: {{ default (include "application.name" .) .Values.rbac.serviceAccount.name }}
6+
name: {{ template "application.service-account-name" . }}
77
namespace: {{ template "application.namespace" . }}
88
labels:
99
{{- include "application.labels" $ | nindent 4 }}

‎application/tests/cronjob_test.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,3 +77,47 @@ tests:
7777
- equal:
7878
path: spec.jobTemplate.spec.template.spec.containers[0].image
7979
value: example-image:example-tag@sha256:example-digest
80+
81+
- it: yields empty service account name when disabled
82+
set:
83+
cronJob:
84+
enabled: true
85+
jobs:
86+
example:
87+
image:
88+
repository: example-image
89+
rbac.serviceAccount.enabled: false
90+
asserts:
91+
- isNullOrEmpty:
92+
path: spec.jobTemplate.spec.template.spec.serviceAccountName
93+
94+
- it: uses service account name override when present
95+
set:
96+
cronJob:
97+
enabled: true
98+
jobs:
99+
example:
100+
image:
101+
repository: example-image
102+
rbac.serviceAccount.enabled: true
103+
rbac.serviceAccount.name: example-sa
104+
asserts:
105+
- equal:
106+
path: spec.jobTemplate.spec.template.spec.serviceAccountName
107+
value: example-sa
108+
109+
- it: uses a generated service account name when not given
110+
set:
111+
cronJob:
112+
enabled: true
113+
jobs:
114+
example:
115+
image:
116+
repository: example-image
117+
applicationName: example-app
118+
rbac.serviceAccount.enabled: true
119+
rbac.serviceAccount.name: ""
120+
asserts:
121+
- equal:
122+
path: spec.jobTemplate.spec.template.spec.serviceAccountName
123+
value: example-app

‎application/tests/deployment_test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ tests:
9191
set:
9292
rbac.serviceAccount.enabled: false
9393
asserts:
94-
- notExists:
94+
- isNullOrEmpty:
9595
path: spec.template.spec.serviceAccountName
9696

9797
- it: uses service account name override when present

‎application/tests/job_test.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,3 +95,47 @@ tests:
9595
path: spec.template.metadata.annotations
9696
value:
9797
helm.sh/hook: "pre-install,pre-upgrade"
98+
99+
- it: yields empty service account name when disabled
100+
set:
101+
job:
102+
enabled: true
103+
jobs:
104+
example:
105+
image:
106+
repository: example-image
107+
rbac.serviceAccount.enabled: false
108+
asserts:
109+
- isNullOrEmpty:
110+
path: spec.template.spec.serviceAccountName
111+
112+
- it: uses service account name override when present
113+
set:
114+
job:
115+
enabled: true
116+
jobs:
117+
example:
118+
image:
119+
repository: example-image
120+
rbac.serviceAccount.enabled: true
121+
rbac.serviceAccount.name: example-sa
122+
asserts:
123+
- equal:
124+
path: spec.template.spec.serviceAccountName
125+
value: example-sa
126+
127+
- it: uses a generated service account name when not given
128+
set:
129+
job:
130+
enabled: true
131+
jobs:
132+
example:
133+
image:
134+
repository: example-image
135+
applicationName: example-app
136+
rbac.serviceAccount.enabled: true
137+
rbac.serviceAccount.name: ""
138+
asserts:
139+
- equal:
140+
path: spec.template.spec.serviceAccountName
141+
value: example-app

‎application/values.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -654,6 +654,9 @@ rbac:
654654
# -- (bool) Enable RBAC.
655655
# @section -- RBAC Parameters
656656
enabled: true
657+
# -- (string) Existing Service Account Name.
658+
# @section -- RBAC Parameters
659+
existingServiceAccountName: ""
657660
serviceAccount:
658661
# -- (bool) Deploy Service Account.
659662
# @section -- RBAC Parameters

0 commit comments

Comments
 (0)