From 18df047bdf1f22b91323b5830be03338cef0e744 Mon Sep 17 00:00:00 2001 From: Tanguy Buchier Date: Thu, 14 Mar 2019 08:36:47 +0800 Subject: [PATCH] [stable/kube-state-metrics] Add imagePullSecrets in serviceAccount (#11405) * [stable/kube-state-metrics] Add imagePullSecrets in serviceAccount Signed-off-by: Tanguy Buchier * [stable/kube-state-metrics] Add imagePullSecrets in serviceAccount Signed-off-by: Tanguy Buchier * [stable/kube-state-metrics] Add imagePullSecrets in serviceAccount Signed-off-by: Tanguy Buchier --- stable/kube-state-metrics/Chart.yaml | 2 +- stable/kube-state-metrics/README.md | 4 +++- stable/kube-state-metrics/templates/_helpers.tpl | 11 +++++++++++ .../kube-state-metrics/templates/deployment.yaml | 4 +++- .../templates/serviceaccount.yaml | 4 ++++ stable/kube-state-metrics/values.yaml | 14 ++++++++++++-- 6 files changed, 34 insertions(+), 5 deletions(-) diff --git a/stable/kube-state-metrics/Chart.yaml b/stable/kube-state-metrics/Chart.yaml index 4ba33e90ba..a90440c18b 100644 --- a/stable/kube-state-metrics/Chart.yaml +++ b/stable/kube-state-metrics/Chart.yaml @@ -5,7 +5,7 @@ keywords: - metric - monitoring - prometheus -version: 0.14.1 +version: 0.15.0 appVersion: 1.5.0 home: https://github.com/kubernetes/kube-state-metrics/ sources: diff --git a/stable/kube-state-metrics/README.md b/stable/kube-state-metrics/README.md index bcab1b2331..f418c136bd 100644 --- a/stable/kube-state-metrics/README.md +++ b/stable/kube-state-metrics/README.md @@ -20,9 +20,11 @@ $ helm install stable/kube-state-metrics | `service.port` | The port of the container | 8080 | | `prometheusScrape` | Whether or not enable prom scrape | true | | `rbac.create` | If true, create & use RBAC resources | true | +| `serviceAccount.create` | If true, and rbac true, create & use serviceAccount | true | +| `serviceAccount.name` | If not set & create is true, use template fullname | | +| `serviceAccount.imagePullSecrets` | Specify image pull secrets field | `[]` | | `podSecurityPolicy.enabled` | If true, create & use PodSecurityPolicy resources | false | | `podSecurityPolicy.annotations` | Specify pod annotations in the pod security policy | {} | -| `rbac.serviceAccountName` | ServiceAccount to be used (ignored if rbac.create=true) | default | | `securityContext.enabled` | Enable security context | `true` | | `securityContext.fsGroup` | Group ID for the container | `65534` | | `securityContext.runAsUser` | User ID for the container | `65534` | diff --git a/stable/kube-state-metrics/templates/_helpers.tpl b/stable/kube-state-metrics/templates/_helpers.tpl index 787d0c283b..e59ada57ca 100644 --- a/stable/kube-state-metrics/templates/_helpers.tpl +++ b/stable/kube-state-metrics/templates/_helpers.tpl @@ -23,3 +23,14 @@ If release name contains chart name it will be used as a full name. {{- end -}} {{- end -}} {{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "kube-state-metrics.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "kube-state-metrics.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/stable/kube-state-metrics/templates/deployment.yaml b/stable/kube-state-metrics/templates/deployment.yaml index e760aeb3bf..56a7598ef7 100644 --- a/stable/kube-state-metrics/templates/deployment.yaml +++ b/stable/kube-state-metrics/templates/deployment.yaml @@ -19,7 +19,9 @@ spec: {{ toYaml .Values.podAnnotations | indent 8 }} {{- end }} spec: - serviceAccountName: {{ if .Values.rbac.create }}{{ template "kube-state-metrics.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} +{{ if .Values.rbac.create }} + serviceAccountName: {{ template "kube-state-metrics.serviceAccountName" . }} +{{ end }} {{- if .Values.securityContext.enabled }} securityContext: fsGroup: {{ .Values.securityContext.fsGroup }} diff --git a/stable/kube-state-metrics/templates/serviceaccount.yaml b/stable/kube-state-metrics/templates/serviceaccount.yaml index f1e125971e..edac3b99ff 100644 --- a/stable/kube-state-metrics/templates/serviceaccount.yaml +++ b/stable/kube-state-metrics/templates/serviceaccount.yaml @@ -1,4 +1,5 @@ {{- if .Values.rbac.create -}} +{{- if .Values.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount metadata: @@ -8,4 +9,7 @@ metadata: heritage: {{ .Release.Service }} release: {{ .Release.Name }} name: {{ template "kube-state-metrics.fullname" . }} +imagePullSecrets: +{{ toYaml .Values.serviceAccount.imagePullSecrets | indent 2 }} +{{- end -}} {{- end -}} diff --git a/stable/kube-state-metrics/values.yaml b/stable/kube-state-metrics/values.yaml index 48ae8ac4f4..611b007849 100644 --- a/stable/kube-state-metrics/values.yaml +++ b/stable/kube-state-metrics/values.yaml @@ -4,17 +4,27 @@ image: repository: k8s.gcr.io/kube-state-metrics tag: v1.5.0 pullPolicy: IfNotPresent + service: port: 8080 # Default to clusterIP for backward compatibility type: ClusterIP nodePort: 0 loadBalancerIP: "" + rbac: # If true, create & use RBAC resources create: true - # Ignored if rbac.create is true - serviceAccountName: default + +serviceAccount: + # Specifies whether a ServiceAccount should be created, require rbac true + create: true + # The name of the ServiceAccount to use. + # If not set and create is true, a name is generated using the fullname template + name: + # Reference to one or more secrets to be used when pulling images + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + imagePullSecrets: [] ## Specify if a Pod Security Policy for kube-state-metrics must be created ## Ref: https://kubernetes.io/docs/concepts/policy/pod-security-policy/