feat!: harmonize service account binding #major #363
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
aslafy-z
force-pushed
the
aslafy-z-patch-3
branch
2 times, most recently
from
0ef820d to
7d495fb
Compare
aslafy-z
force-pushed
the
aslafy-z-patch-3
branch
from
7d495fb to
c127a42
Compare
d3adb5
requested changes
Jan 7, 2025
application/templates/_helpers.tpl
Outdated
| {{- if .Values.rbac.serviceAccount.enabled }} | ||
| {{- default (include "application.name" .) .Values.rbac.serviceAccount.name }} | ||
| {{- else }} | ||
| {{- default "null" .Values.rbac.existingServiceAccountName }} |
There was a problem hiding this comment.
Edge case, may or may not be something to take into consideration: service accounts named null. Also, we're assuming the result of this partial template to be interpreted as YAML rather than a raw string, that may create confusion.
Suggested change
| {{- default "null" .Values.rbac.existingServiceAccountName }} | |
| {{- $saName := .Values.rbac.existingServiceAccountName }} | |
| {{- empty $saName | ternary (quote $saName) "null" }} |
There was a problem hiding this comment.
the partial now only returns strings, do you think i should still quote the output?
There was a problem hiding this comment.
I think it's a good idea, yes, since the output is supposed to be a string.
aslafy-z
force-pushed
the
aslafy-z-patch-3
branch
4 times, most recently
from
4662e88 to
a6b974e
Compare
aslafy-z
changed the title
aslafy-z
changed the title
aslafy-z
force-pushed
the
aslafy-z-patch-3
branch
from
a6b974e to
6d404a8
Compare
aslafy-z
changed the title
aslafy-z
force-pushed
the
aslafy-z-patch-3
branch
from
6d404a8 to
0c15cb1
Compare
aslafy-z
force-pushed
the
aslafy-z-patch-3
branch
from
0c15cb1 to
de41a4f
Compare
d3adb5
requested changes
Feb 7, 2025
| serviceAccountName: {{ template "application.name" $ }} | ||
| {{- end }} | ||
| {{- end }} | ||
| serviceAccountName: {{ include "application.serviceAccountName" $ }} |
There was a problem hiding this comment.
This may be another feature, but personally, I think we should add this:
Suggested change
| serviceAccountName: {{ include "application.serviceAccountName" $ }} | |
| automountServiceAccountToken: {{ $.Values.rbac.enabled }} | |
| serviceAccountName: {{ include "application.serviceAccountName" $ }} |
If RBAC is disabled, we shouldn't even allow mounting tokens for the default service account, I'd say. What do you think?
| @@ -74,6 +74,7 @@ spec: | |||
| ] | |||
| {{- end }} | |||
| spec: | |||
| serviceAccountName: {{ include "application.serviceAccountName" $ }} | |||
There was a problem hiding this comment.
Same comment as in the other thread.
Suggested change
| serviceAccountName: {{ include "application.serviceAccountName" $ }} | |
| automountServiceAccount: {{ $.Values.rbac.enabled }} | |
| serviceAccountName: {{ include "application.serviceAccountName" $ }} |
| serviceAccountName: {{ template "application.name" $ }} | ||
| {{- end }} | ||
| {{- end }} | ||
| serviceAccountName: {{ include "application.serviceAccountName" $ }} |
There was a problem hiding this comment.
Same comment as in the other threads.
Suggested change
| serviceAccountName: {{ include "application.serviceAccountName" $ }} | |
| automountServiceAccount: {{ $.Values.rbac.enabled }} | |
| serviceAccountName: {{ include "application.serviceAccountName" $ }} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #320
Closes #361
BREAKING: Rename
rbac.serviceAccount.enabledfield torbac.serviceAccount.create.Fix inconsistencies in serviceAccount binding across
CronJob,Job, andDeploymenttemplates by introducing a newapplication.serviceAccountNametemplate:rbac.serviceAccount.createrbac.serviceAccount.nametrue""(include "application.name" .)true"foo""foo"false"""default"false"bar""bar"