feat: add service accounts for extensions

Author: ReuDa

charts/steadybit-extension-scaffold/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v2
 name: steadybit-extension-scaffold
 description: Steadybit scaffold extension Helm chart for Kubernetes.
-version: 1.0.15
+version: 1.0.16
 appVersion: latest
 home: https://www.steadybit.com/
 icon: https://steadybit-website-assets.s3.amazonaws.com/logo-symbol-transparent.png

charts/steadybit-extension-scaffold/templates/deployment.yaml

@@ -66,6 +66,7 @@ spec:
             runAsGroup: 10000
       volumes:
         {{- include "extensionlib.deployment.volumes" (list .) | nindent 8 }}
+      serviceAccountName: {{ .Values.serviceAccount.name }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
       {{- toYaml . | nindent 8 }}

charts/steadybit-extension-scaffold/templates/serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+  {{- range $key, $value := .Values.extraLabels }}
+    {{ $key }}: {{ $value }}
+  {{- end }}
+automountServiceAccountToken: true
+{{- end }}

charts/steadybit-extension-scaffold/tests/__snapshot__/deployment_test.yaml.snap

@@ -51,6 +51,7 @@ manifest should match snapshot using podAnnotations and Labels:
                 runAsNonRoot: true
                 runAsUser: 10000
               volumeMounts: null
+          serviceAccountName: steadybit-extension-scaffold
           volumes: null
 manifest should match snapshot with TLS:
   1: |
@@ -110,6 +111,7 @@ manifest should match snapshot with TLS:
                 - mountPath: /etc/extension/certificates/server-cert
                   name: certificate-server-cert
                   readOnly: true
+          serviceAccountName: steadybit-extension-scaffold
           volumes:
             - name: certificate-server-cert
               secret:
@@ -173,6 +175,7 @@ manifest should match snapshot with extra env vars:
                 runAsNonRoot: true
                 runAsUser: 10000
               volumeMounts: null
+          serviceAccountName: steadybit-extension-scaffold
           volumes: null
 manifest should match snapshot with extra labels:
   1: |
@@ -227,6 +230,7 @@ manifest should match snapshot with extra labels:
                 runAsNonRoot: true
                 runAsUser: 10000
               volumeMounts: null
+          serviceAccountName: steadybit-extension-scaffold
           volumes: null
 manifest should match snapshot with mutual TLS:
   1: |
@@ -291,6 +295,7 @@ manifest should match snapshot with mutual TLS:
                 - mountPath: /etc/extension/certificates/server-cert
                   name: certificate-server-cert
                   readOnly: true
+          serviceAccountName: steadybit-extension-scaffold
           volumes:
             - name: certificate-client-cert-a
               secret:
@@ -357,6 +362,7 @@ manifest should match snapshot with mutual TLS using containerPaths:
                 runAsNonRoot: true
                 runAsUser: 10000
               volumeMounts: null
+          serviceAccountName: steadybit-extension-scaffold
           volumes: null
 manifest should match snapshot without TLS:
   1: |
@@ -409,4 +415,5 @@ manifest should match snapshot without TLS:
                 runAsNonRoot: true
                 runAsUser: 10000
               volumeMounts: null
+          serviceAccountName: steadybit-extension-scaffold
           volumes: null

charts/steadybit-extension-scaffold/tests/__snapshot__/serviceaccount_test.yaml.snap

@@ -0,0 +1,9 @@
+manifest should match snapshot:
+  1: |
+    apiVersion: v1
+    automountServiceAccountToken: true
+    kind: ServiceAccount
+    metadata:
+      labels: null
+      name: steadybit-extension-scaffold
+      namespace: NAMESPACE

charts/steadybit-extension-scaffold/tests/serviceaccount_test.yaml

@@ -0,0 +1,6 @@
+templates:
+  - serviceaccount.yaml
+tests:
+  - it: manifest should match snapshot
+    asserts:
+      - matchSnapshot: { }

charts/steadybit-extension-scaffold/values.yaml

@@ -48,6 +48,12 @@ resources:
     # resources.limits.cpu -- The limit of cpu share to be used during its interval
     cpu: "200m"
 
+serviceAccount:
+  # serviceAccount.create -- Specifies whether a ServiceAccount should be created.
+  create: true
+  # serviceAccount.name -- The name of the ServiceAccount to use.
+  name: steadybit-extension-scaffold
+
 # extra labels to apply to the Kubernetes resources
 extraLabels: {}