From 8263ba38aa3111df753be0a5e8452d9cf6fe5755 Mon Sep 17 00:00:00 2001 From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> Date: Fri, 21 Feb 2025 10:44:49 +0100 Subject: [PATCH] allow to specify image pull secrets for service accounts Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com> --- charts/shuffle/README.md | 6 + charts/shuffle/templates/_helpers.tpl | 186 ++++++++++++++++-- .../templates/backend/backend-dpl.yaml | 4 +- .../backend/backend-role-binding.yaml | 2 +- .../backend/backend-service-account.yaml | 3 +- .../templates/frontend/frontend-dpl.yaml | 4 +- .../frontend/frontend-service-account.yaml | 3 +- .../templates/orborus/orborus-cm-env.yaml | 2 +- .../templates/orborus/orborus-dpl.yaml | 8 +- .../orborus/orborus-role-binding.yaml | 2 +- .../orborus/orborus-service-account.yaml | 3 +- .../shuffle-app/shuffle-app-role-binding.yaml | 2 +- .../shuffle-app-service-account.yaml | 3 +- .../shuffle-worker-role-binding.yaml | 2 +- .../shuffle-worker-service-account.yaml | 3 +- charts/shuffle/values.schema.json | 30 +++ charts/shuffle/values.yaml | 15 ++ 17 files changed, 248 insertions(+), 30 deletions(-) diff --git a/charts/shuffle/README.md b/charts/shuffle/README.md index 27d7aeba..051687e0 100644 --- a/charts/shuffle/README.md +++ b/charts/shuffle/README.md @@ -242,6 +242,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `backend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `backend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `backend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `backend.serviceAccount.imagePullSecrets` | Add image pull secrets to the backend service account | `[]` | | `backend.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `backend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `backend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -359,6 +360,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `frontend.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `frontend.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `frontend.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `frontend.serviceAccount.imagePullSecrets` | Add image pull secrets to the frontend service account | `[]` | | `frontend.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `frontend.networkPolicy.allowExternal` | Don't require server label for connections | `true` | | `frontend.networkPolicy.allowExternalEgress` | Allow the pod to access any range of port and all destinations. | `true` | @@ -465,6 +467,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `orborus.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `orborus.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `orborus.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `orborus.serviceAccount.imagePullSecrets` | Add image pull secrets to the orborus service account | `[]` | | `orborus.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `orborus.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `orborus.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -483,6 +486,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `worker.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `worker.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `worker.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `worker.serviceAccount.imagePullSecrets` | Add image pull secrets to the worker service account | `[]` | | `worker.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `worker.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `worker.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -498,6 +502,7 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" | `app.serviceAccount.name` | The name of the ServiceAccount to use. | `""` | | `app.serviceAccount.annotations` | Additional Service Account annotations (evaluated as a template) | `{}` | | `app.serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `app.serviceAccount.imagePullSecrets` | Add image pull secrets to the app service account | `[]` | | `app.rbac.create` | Specifies whether RBAC resources should be created | `true` | | `app.networkPolicy.enabled` | Specifies whether a NetworkPolicy should be created | `true` | | `app.networkPolicy.allowExternal` | Don't require server label for connections | `true` | @@ -601,3 +606,4 @@ SHUFFLE_ENCRYPTION_MODIFIER: "MyShuffleEncryptionModifier" ### Other Parameters + diff --git a/charts/shuffle/templates/_helpers.tpl b/charts/shuffle/templates/_helpers.tpl index 369dfec1..6bd29238 100644 --- a/charts/shuffle/templates/_helpers.tpl +++ b/charts/shuffle/templates/_helpers.tpl @@ -1,10 +1,3 @@ -{{/* -Return the proper Docker Image Registry Secret Names -*/}} -{{- define "shuffle.imagePullSecrets" -}} -{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image .Values.frontend.image .Values.orborus.image .Values.worker.image .Values.volumePermissions.image) "context" $) -}} -{{- end -}} - {{/* Return the common name for backend componentes */}} @@ -136,6 +129,13 @@ Return the proper Shuffle backend image name {{- include "common.images.image" ( dict "imageRoot" .Values.backend.image "global" .Values.global ) -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the backend pod +*/}} +{{- define "shuffle.backend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.backend.image) "context" $) -}} +{{- end -}} + {{/* Return the proper Shuffle frontend image name */}} @@ -143,6 +143,13 @@ Return the proper Shuffle frontend image name {{- include "common.images.image" ( dict "imageRoot" .Values.frontend.image "global" .Values.global ) -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the frontend pod +*/}} +{{- define "shuffle.frontend.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.frontend.image) "context" $) -}} +{{- end -}} + {{/* Return the proper Shuffle orborus image name */}} @@ -150,6 +157,13 @@ Return the proper Shuffle orborus image name {{- include "common.images.image" ( dict "imageRoot" .Values.orborus.image "global" .Values.global ) -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the orborus pod +*/}} +{{- define "shuffle.orborus.imagePullSecrets" -}} +{{- include "common.images.renderPullSecrets" (dict "images" (list .Values.orborus.image) "context" $) -}} +{{- end -}} + {{/* Return the proper Shuffle worker image name */}} @@ -160,7 +174,7 @@ Return the proper Shuffle worker image name {{/* Create the name of the service account to use for the Shuffle backend */}} -{{- define "shuffle.backend.serviceAccountName" -}} +{{- define "shuffle.backend.serviceAccount.name" -}} {{- if .Values.backend.serviceAccount.create -}} {{ default (include "shuffle.backend.name" .) .Values.backend.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -168,10 +182,40 @@ Create the name of the service account to use for the Shuffle backend {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the backend service account +*/}} +{{- define "shuffle.backend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.backend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for the Shuffle frontend */}} -{{- define "shuffle.frontend.serviceAccountName" -}} +{{- define "shuffle.frontend.serviceAccount.name" -}} {{- if .Values.frontend.serviceAccount.create -}} {{ default (include "shuffle.frontend.name" .) .Values.frontend.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -179,10 +223,40 @@ Create the name of the service account to use for the Shuffle frontend {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the frontend service account +*/}} +{{- define "shuffle.frontend.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.frontend.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for Shuffle orborus */}} -{{- define "shuffle.orborus.serviceAccountName" -}} +{{- define "shuffle.orborus.serviceAccount.name" -}} {{- if .Values.orborus.serviceAccount.create -}} {{ default (include "shuffle.orborus.name" .) .Values.orborus.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -190,10 +264,40 @@ Create the name of the service account to use for Shuffle orborus {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the orborus service account +*/}} +{{- define "shuffle.orborus.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.orborus.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for Shuffle workers */}} -{{- define "shuffle.worker.serviceAccountName" -}} +{{- define "shuffle.worker.serviceAccount.name" -}} {{- if .Values.worker.serviceAccount.create -}} {{ default (include "shuffle.worker.name" .) .Values.worker.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -201,10 +305,40 @@ Create the name of the service account to use for Shuffle workers {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the worker service account +*/}} +{{- define "shuffle.worker.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} + +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.worker.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} + {{/* Create the name of the service account to use for Shuffle apps */}} -{{- define "shuffle.app.serviceAccountName" -}} +{{- define "shuffle.app.serviceAccount.name" -}} {{- if .Values.app.serviceAccount.create -}} {{ default (include "shuffle.app.name" .) .Values.app.serviceAccount.name | trunc 63 | trimSuffix "-" }} {{- else -}} @@ -212,4 +346,32 @@ Create the name of the service account to use for Shuffle apps {{- end -}} {{- end -}} +{{/* +Return the proper Docker Image Registry Secret Names for the app service account +*/}} +{{- define "shuffle.app.serviceAccount.imagePullSecrets" -}} +{{- $pullSecrets := list }} +{{- range .Values.global.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- range .Values.app.serviceAccount.imagePullSecrets -}} + {{- if kindIs "map" . -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" .name "context" .)) -}} + {{- else -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" .)) -}} + {{- end -}} +{{- end -}} + +{{- if (not (empty $pullSecrets)) -}} +imagePullSecrets: +{{- range $pullSecrets | uniq }} + - name: {{ . }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/charts/shuffle/templates/backend/backend-dpl.yaml b/charts/shuffle/templates/backend/backend-dpl.yaml index ecf52e20..b1cc606c 100644 --- a/charts/shuffle/templates/backend/backend-dpl.yaml +++ b/charts/shuffle/templates/backend/backend-dpl.yaml @@ -25,8 +25,8 @@ spec: {{- end }} labels: {{- include "shuffle.backend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} spec: - {{- include "shuffle.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ template "shuffle.backend.serviceAccountName" . }} + {{- include "shuffle.backend.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.backend.serviceAccount.name" . }} automountServiceAccountToken: {{ .Values.backend.automountServiceAccountToken }} {{- if .Values.backend.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.backend.hostAliases "context" $) | nindent 8 }} diff --git a/charts/shuffle/templates/backend/backend-role-binding.yaml b/charts/shuffle/templates/backend/backend-role-binding.yaml index ffbe3ce0..171e2c98 100644 --- a/charts/shuffle/templates/backend/backend-role-binding.yaml +++ b/charts/shuffle/templates/backend/backend-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.backend.serviceAccountName" . }} + name: {{ include "shuffle.backend.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/backend/backend-service-account.yaml b/charts/shuffle/templates/backend/backend-service-account.yaml index efe96b6a..5a49ba3a 100644 --- a/charts/shuffle/templates/backend/backend-service-account.yaml +++ b/charts/shuffle/templates/backend/backend-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.backend.serviceAccountName" . }} + name: {{ include "shuffle.backend.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.backend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.backend.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.backend.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.backend.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/frontend/frontend-dpl.yaml b/charts/shuffle/templates/frontend/frontend-dpl.yaml index b3a68dbb..1a984eaf 100644 --- a/charts/shuffle/templates/frontend/frontend-dpl.yaml +++ b/charts/shuffle/templates/frontend/frontend-dpl.yaml @@ -25,8 +25,8 @@ spec: {{- end }} labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} spec: - {{- include "shuffle.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ template "shuffle.frontend.serviceAccountName" . }} + {{- include "shuffle.frontend.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.frontend.serviceAccount.name" . }} automountServiceAccountToken: {{ .Values.frontend.automountServiceAccountToken }} {{- if .Values.frontend.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.frontend.hostAliases "context" $) | nindent 8 }} diff --git a/charts/shuffle/templates/frontend/frontend-service-account.yaml b/charts/shuffle/templates/frontend/frontend-service-account.yaml index a55fad19..d580dd3e 100644 --- a/charts/shuffle/templates/frontend/frontend-service-account.yaml +++ b/charts/shuffle/templates/frontend/frontend-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.frontend.serviceAccountName" . }} + name: {{ include "shuffle.frontend.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.frontend.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.frontend.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.frontend.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.frontend.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-cm-env.yaml b/charts/shuffle/templates/orborus/orborus-cm-env.yaml index b49ce510..57b020a7 100644 --- a/charts/shuffle/templates/orborus/orborus-cm-env.yaml +++ b/charts/shuffle/templates/orborus/orborus-cm-env.yaml @@ -13,7 +13,7 @@ data: TZ: "{{ .Values.shuffle.timezone }}" BASE_URL: "http://{{ include "shuffle.backend.name" . }}.{{ .Release.Namespace }}.svc.cluster.local:5001" KUBERNETES_NAMESPACE: "{{ .Release.Namespace }}" - KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccountName" . }} + KUBERNETES_SERVICE_ACCOUNT: {{ include "shuffle.orborus.serviceAccount.name" . }} SHUFFLE_WORKER_IMAGE: "{{ include "shuffle.worker.image" . }}" REGISTRY_URL: "{{ .Values.shuffle.appRegistry }}" SHUFFLE_SWARM_CONFIG: run diff --git a/charts/shuffle/templates/orborus/orborus-dpl.yaml b/charts/shuffle/templates/orborus/orborus-dpl.yaml index 0d3488f0..a2d9c278 100644 --- a/charts/shuffle/templates/orborus/orborus-dpl.yaml +++ b/charts/shuffle/templates/orborus/orborus-dpl.yaml @@ -25,8 +25,8 @@ spec: {{- end }} labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" $podLabels "context" $ ) | nindent 8 }} spec: - {{- include "shuffle.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ template "shuffle.orborus.serviceAccountName" . }} + {{- include "shuffle.orborus.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "shuffle.orborus.serviceAccount.name" . }} automountServiceAccountToken: {{ .Values.orborus.automountServiceAccountToken }} {{- if .Values.orborus.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.orborus.hostAliases "context" $) | nindent 8 }} @@ -87,9 +87,9 @@ spec: - name: IS_KUBERNETES value: "true" - name: SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME - value: {{ include "shuffle.worker.serviceAccountName" . }} + value: {{ include "shuffle.worker.serviceAccount.name" . }} - name: SHUFFLE_APP_SERVICE_ACCOUNT_NAME - value: {{ include "shuffle.app.serviceAccountName" . }} + value: {{ include "shuffle.app.serviceAccount.name" . }} {{- if .Values.orborus.extraEnvVars }} {{- include "common.tplvalues.render" (dict "value" .Values.orborus.extraEnvVars "context" $) | nindent 12 }} {{- end }} diff --git a/charts/shuffle/templates/orborus/orborus-role-binding.yaml b/charts/shuffle/templates/orborus/orborus-role-binding.yaml index f4c2689e..feb73887 100644 --- a/charts/shuffle/templates/orborus/orborus-role-binding.yaml +++ b/charts/shuffle/templates/orborus/orborus-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.orborus.serviceAccountName" . }} + name: {{ include "shuffle.orborus.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/orborus/orborus-service-account.yaml b/charts/shuffle/templates/orborus/orborus-service-account.yaml index 4a5c7f3a..27c4b9f6 100644 --- a/charts/shuffle/templates/orborus/orborus-service-account.yaml +++ b/charts/shuffle/templates/orborus/orborus-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.orborus.serviceAccountName" . }} + name: {{ include "shuffle.orborus.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.orborus.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.orborus.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.orborus.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.orborus.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml index ec369148..55a166e7 100644 --- a/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.app.serviceAccountName" . }} + name: {{ include "shuffle.app.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml index f5e4befe..736e9957 100644 --- a/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml +++ b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.app.serviceAccountName" . }} + name: {{ include "shuffle.app.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.app.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.app.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.app.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.app.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml index 1e952733..328b3dd5 100644 --- a/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml @@ -10,7 +10,7 @@ metadata: {{- end }} subjects: - kind: ServiceAccount - name: {{ include "shuffle.worker.serviceAccountName" . }} + name: {{ include "shuffle.worker.serviceAccount.name" . }} roleRef: apiGroup: rbac.authorization.k8s.io kind: Role diff --git a/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml index e27395f0..a9a90204 100644 --- a/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml +++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "shuffle.worker.serviceAccountName" . }} + name: {{ include "shuffle.worker.serviceAccount.name" . }} namespace: {{ include "common.names.namespace" . | quote }} labels: {{- include "shuffle.worker.labels" ( dict "customLabels" .Values.commonLabels "context" $ ) | nindent 4 }} {{- if or .Values.worker.serviceAccount.annotations .Values.commonAnnotations }} @@ -10,4 +10,5 @@ metadata: annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $ ) | nindent 4 }} {{- end }} automountServiceAccountToken: {{ .Values.worker.serviceAccount.automountServiceAccountToken }} +{{- include "shuffle.worker.serviceAccount.imagePullSecrets" . | nindent 0 }} {{- end }} diff --git a/charts/shuffle/values.schema.json b/charts/shuffle/values.schema.json index d5ad8fe9..f7745e6e 100644 --- a/charts/shuffle/values.schema.json +++ b/charts/shuffle/values.schema.json @@ -715,6 +715,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the backend service account", + "default": [], + "items": {} } } }, @@ -1398,6 +1404,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the frontend service account", + "default": [], + "items": {} } } }, @@ -2011,6 +2023,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the orborus service account", + "default": [], + "items": {} } } }, @@ -2103,6 +2121,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the worker service account", + "default": [], + "items": {} } } }, @@ -2175,6 +2199,12 @@ "type": "boolean", "description": "Automount service account token for the server service account", "default": true + }, + "imagePullSecrets": { + "type": "array", + "description": "Add image pull secrets to the app service account", + "default": [], + "items": {} } } }, diff --git a/charts/shuffle/values.yaml b/charts/shuffle/values.yaml index 91103002..60fde98d 100644 --- a/charts/shuffle/values.yaml +++ b/charts/shuffle/values.yaml @@ -456,6 +456,9 @@ backend: ## @param backend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param backend.serviceAccount.imagePullSecrets Add image pull secrets to the backend service account + ## + imagePullSecrets: [] ## RBAC configuration ## @@ -921,6 +924,9 @@ frontend: ## @param frontend.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param frontend.serviceAccount.imagePullSecrets Add image pull secrets to the frontend service account + ## + imagePullSecrets: [] ## Network Policies ## Ref: https://kubernetes.io/docs/concepts/services-networking/network-policies/ @@ -1322,6 +1328,9 @@ orborus: ## @param orborus.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param orborus.serviceAccount.imagePullSecrets Add image pull secrets to the orborus service account + ## + imagePullSecrets: [] ## RBAC configuration ## @@ -1393,6 +1402,9 @@ worker: ## @param worker.serviceAccount.automountServiceAccountToken Automount service account token for the server service account ## automountServiceAccountToken: true + ## @param worker.serviceAccount.imagePullSecrets Add image pull secrets to the worker service account + ## + imagePullSecrets: [] ## RBAC configuration ## @@ -1461,6 +1473,9 @@ app: ## istio: pilot ## automountServiceAccountToken: true + ## @param app.serviceAccount.imagePullSecrets Add image pull secrets to the app service account + ## + imagePullSecrets: [] ## RBAC configuration ##