From af2d58155c195ce9002d646fbe9b04e035744702 Mon Sep 17 00:00:00 2001
From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
Date: Wed, 19 Feb 2025 12:36:47 +0100
Subject: [PATCH] use app and worker service accounts in role binding

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
---
 .../shuffle-app-network-policy.yaml}                          | 0
 .../shuffle-app-role-binding.yaml}                            | 4 +---
 .../shuffle-app-role.yaml}                                    | 0
 .../shuffle-app-service-account.yaml}                         | 0
 .../shuffle-worker-network-policy.yaml}                       | 0
 .../shuffle-worker-role-binding.yaml}                         | 4 +---
 .../shuffle-worker-role.yaml}                                 | 0
 .../shuffle-worker-service-account.yaml}                      | 0
 8 files changed, 2 insertions(+), 6 deletions(-)
 rename charts/shuffle/templates/{orborus-app/orborus-app-network-policy.yaml => shuffle-app/shuffle-app-network-policy.yaml} (100%)
 rename charts/shuffle/templates/{orborus-app/orborus-app-role-binding.yaml => shuffle-app/shuffle-app-role-binding.yaml} (77%)
 rename charts/shuffle/templates/{orborus-app/orborus-app-role.yaml => shuffle-app/shuffle-app-role.yaml} (100%)
 rename charts/shuffle/templates/{orborus-app/orborus-app-service-account.yaml => shuffle-app/shuffle-app-service-account.yaml} (100%)
 rename charts/shuffle/templates/{orborus-worker/orborus-worker-network-policy.yaml => shuffle-worker/shuffle-worker-network-policy.yaml} (100%)
 rename charts/shuffle/templates/{orborus-worker/orborus-worker-role-binding.yaml => shuffle-worker/shuffle-worker-role-binding.yaml} (77%)
 rename charts/shuffle/templates/{orborus-worker/orborus-worker-role.yaml => shuffle-worker/shuffle-worker-role.yaml} (100%)
 rename charts/shuffle/templates/{orborus-worker/orborus-worker-service-account.yaml => shuffle-worker/shuffle-worker-service-account.yaml} (100%)

diff --git a/charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
similarity index 100%
rename from charts/shuffle/templates/orborus-app/orborus-app-network-policy.yaml
rename to charts/shuffle/templates/shuffle-app/shuffle-app-network-policy.yaml
diff --git a/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml
similarity index 77%
rename from charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml
rename to charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml
index 91115fb4..ec369148 100644
--- a/charts/shuffle/templates/orborus-app/orborus-app-role-binding.yaml
+++ b/charts/shuffle/templates/shuffle-app/shuffle-app-role-binding.yaml
@@ -8,11 +8,9 @@ metadata:
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
-# Deployed shuffle apps will use the default service account. There is currently no way to change that.
-# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260
 subjects:
   - kind: ServiceAccount
-    name: default
+    name: {{ include "shuffle.app.serviceAccountName" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/charts/shuffle/templates/orborus-app/orborus-app-role.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml
similarity index 100%
rename from charts/shuffle/templates/orborus-app/orborus-app-role.yaml
rename to charts/shuffle/templates/shuffle-app/shuffle-app-role.yaml
diff --git a/charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml b/charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml
similarity index 100%
rename from charts/shuffle/templates/orborus-app/orborus-app-service-account.yaml
rename to charts/shuffle/templates/shuffle-app/shuffle-app-service-account.yaml
diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
similarity index 100%
rename from charts/shuffle/templates/orborus-worker/orborus-worker-network-policy.yaml
rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-network-policy.yaml
diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml
similarity index 77%
rename from charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml
rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml
index 71479700..1e952733 100644
--- a/charts/shuffle/templates/orborus-worker/orborus-worker-role-binding.yaml
+++ b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role-binding.yaml
@@ -8,11 +8,9 @@ metadata:
   {{- if .Values.commonAnnotations }}
   annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }}
   {{- end }}
-# Deployed shuffle workers will use the default service account. There is currently no way to change that.
-# https://github.com/Shuffle/Shuffle/pull/1421#issuecomment-2382623260
 subjects:
   - kind: ServiceAccount
-    name: default
+    name: {{ include "shuffle.worker.serviceAccountName" . }}
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml
similarity index 100%
rename from charts/shuffle/templates/orborus-worker/orborus-worker-role.yaml
rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-role.yaml
diff --git a/charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml b/charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml
similarity index 100%
rename from charts/shuffle/templates/orborus-worker/orborus-worker-service-account.yaml
rename to charts/shuffle/templates/shuffle-worker/shuffle-worker-service-account.yaml