Skip to content

Commit 67a195f

Browse files
AlexB-mgtcAntoLC
AlexB-mgtc
authored and
AntoLC
committed
✨(helm) add serviceAccountName parameter for services
Add support for specifying custom service accounts in all Kubernetes resources in our Helm charts to enable workload identity federation with managed cloud services (PostgreSQL, Redis, etc.). This allows deployments to authenticate to cloud resources without embedding credentials in secrets.
1 parent 09b6fef commit 67a195f

9 files changed

+36
-5
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ and this project adheres to
1010

1111
### Added
1212

13+
- ✨(helm) Service Account support for K8s Resources in Helm Charts #778
1314
- ✨(backend) allow masking documents from the list view #1171
1415
- ✨(frontend) subdocs can manage link reach #1190
1516
- ✨(frontend) add duplicate action to doc tree #1175

‎src/helm/impress/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,7 @@
135135
| `backend.extraVolumeMounts` | Additional volumes to mount on the backend. | `[]` |
136136
| `backend.extraVolumes` | Additional volumes to mount on the backend. | `[]` |
137137
| `backend.pdb.enabled` | Enable pdb on backend | `true` |
138+
| `backend.serviceAccountName` | Optional service account name to use for backend pods | `nil` |
138139
| `backend.themeCustomization.enabled` | Enable theme customization | `false` |
139140
| `backend.themeCustomization.file_content` | Content of the theme customization file. Must be a json object. | `""` |
140141
| `backend.themeCustomization.mount_path` | Path where the customization file will be mounted in the backend deployment. | `/app/impress/configuration/theme` |
@@ -198,6 +199,7 @@
198199
| `frontend.extraVolumeMounts` | Additional volumes to mount on the frontend. | `[]` |
199200
| `frontend.extraVolumes` | Additional volumes to mount on the frontend. | `[]` |
200201
| `frontend.pdb.enabled` | Enable pdb on frontend | `true` |
202+
| `frontend.serviceAccountName` | Optional service account name to use for frontend pods | `nil` |
201203

202204
### posthog
203205

@@ -280,3 +282,4 @@
280282
| `yProvider.extraVolumeMounts` | Additional volumes to mount on the yProvider. | `[]` |
281283
| `yProvider.extraVolumes` | Additional volumes to mount on the yProvider. | `[]` |
282284
| `yProvider.pdb.enabled` | Enable pdb on yProvider | `true` |
285+
| `yProvider.serviceAccountName` | Optional service account name to use for yProvider pods | `nil` |

‎src/helm/impress/templates/backend_deployment.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ spec:
3030
imagePullSecrets:
3131
- name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
3232
{{- end}}
33+
{{- if .Values.backend.serviceAccountName }}
34+
serviceAccountName: {{ .Values.backend.serviceAccountName }}
35+
{{- end }}
3336
shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
3437
containers:
3538
{{- with .Values.backend.sidecars }}

‎src/helm/impress/templates/backend_job_createsuperuser.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ spec:
2929
imagePullSecrets:
3030
- name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
3131
{{- end}}
32+
{{- if .Values.backend.serviceAccountName }}
33+
serviceAccountName: {{ .Values.backend.serviceAccountName }}
34+
{{- end }}
3235
shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
3336
containers:
3437
{{- with .Values.backend.sidecars }}

‎src/helm/impress/templates/backend_job_migrate.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,9 @@ spec:
2929
imagePullSecrets:
3030
- name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
3131
{{- end}}
32+
{{- if .Values.backend.serviceAccountName }}
33+
serviceAccountName: {{ .Values.backend.serviceAccountName }}
34+
{{- end }}
3235
shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
3336
containers:
3437
{{- with .Values.backend.sidecars }}

‎src/helm/impress/templates/celery_worker_deployment.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ spec:
3030
imagePullSecrets:
3131
- name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
3232
{{- end}}
33+
{{- if .Values.backend.serviceAccountName }}
34+
serviceAccountName: {{ .Values.backend.serviceAccountName }}
35+
{{- end }}
3336
shareProcessNamespace: {{ .Values.backend.shareProcessNamespace }}
3437
containers:
3538
{{- with .Values.backend.sidecars }}

‎src/helm/impress/templates/frontend_deployment.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ spec:
3030
imagePullSecrets:
3131
- name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
3232
{{- end}}
33+
{{- if .Values.frontend.serviceAccountName }}
34+
serviceAccountName: {{ .Values.frontend.serviceAccountName }}
35+
{{- end }}
3336
shareProcessNamespace: {{ .Values.frontend.shareProcessNamespace }}
3437
containers:
3538
{{- with .Values.frontend.sidecars }}

‎src/helm/impress/templates/yprovider_deployment.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@ spec:
3030
imagePullSecrets:
3131
- name: {{ include "impress.secret.dockerconfigjson.name" (dict "fullname" (include "impress.fullname" .) "imageCredentials" $.Values.image.credentials) }}
3232
{{- end}}
33+
{{- if .Values.yProvider.serviceAccountName }}
34+
serviceAccountName: {{ .Values.yProvider.serviceAccountName }}
35+
{{- end }}
3336
shareProcessNamespace: {{ .Values.yProvider.shareProcessNamespace }}
3437
containers:
3538
{{- with .Values.yProvider.sidecars }}

‎src/helm/impress/values.yaml

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -236,8 +236,8 @@ backend:
236236
targetPort: 8000
237237
annotations: {}
238238

239-
## @param backend.migrate.command backend migrate command
240-
## @param backend.migrate.restartPolicy backend migrate job restart policy
239+
## @param backend.migrate.command backend migrate command
240+
## @param backend.migrate.restartPolicy backend migrate job restart policy
241241
migrate:
242242
command:
243243
- /bin/sh
@@ -254,8 +254,8 @@ backend:
254254
python manage.py migrate --no-input
255255
restartPolicy: Never
256256

257-
## @param backend.createsuperuser.command backend migrate command
258-
## @param backend.createsuperuser.restartPolicy backend migrate job restart policy
257+
## @param backend.createsuperuser.command backend migrate command
258+
## @param backend.createsuperuser.restartPolicy backend migrate job restart policy
259259
createsuperuser:
260260
command:
261261
- "/bin/sh"
@@ -282,7 +282,7 @@ backend:
282282
name: ""
283283
command: []
284284
restartPolicy: Never
285-
annotations:
285+
annotations:
286286
argocd.argoproj.io/hook: PostSync
287287

288288
# List of cronjob to add
@@ -344,6 +344,9 @@ backend:
344344
pdb:
345345
enabled: true
346346

347+
## @param backend.serviceAccountName Optional service account name to use for backend pods
348+
serviceAccountName: null
349+
347350
## @param backend.themeCustomization.enabled Enable theme customization
348351
## @param backend.themeCustomization.file_content Content of the theme customization file. Must be a json object.
349352
## @param backend.themeCustomization.mount_path Path where the customization file will be mounted in the backend deployment.
@@ -480,6 +483,9 @@ frontend:
480483
pdb:
481484
enabled: true
482485

486+
## @param frontend.serviceAccountName Optional service account name to use for frontend pods
487+
serviceAccountName: null
488+
483489
## @section posthog
484490

485491
posthog:
@@ -652,3 +658,6 @@ yProvider:
652658
## @param yProvider.pdb.enabled Enable pdb on yProvider
653659
pdb:
654660
enabled: true
661+
662+
## @param yProvider.serviceAccountName Optional service account name to use for yProvider pods
663+
serviceAccountName: null

0 commit comments

Comments
 (0)