[stable/prometheus-operator] Fix missing rbac.create condition (#9109)

* [stable/prometheus-operator] Fix missing rbac.create condition

Signed-off-by: Jakub Krcma <jakub.krcma@heureka.cz>

* [stable/prometheus-operator] Fix setting a SA when rbac is disabled, but
custom SA is provided

Handles a use case, where the service accounts and roles/binding are
managed centrally by cluster administrators but allowing the regular
users with access to their project namespaces to install Prometheus
using the provided SA/roles/bindings.

Signed-off-by: Jakub Krcma <jakub.krcma@heureka.cz>

stable/prometheus-operator/Chart.yaml

@@ -9,7 +9,7 @@ name: prometheus-operator
 sources:
   - https://github.com/coreos/prometheus-operator
   - https://coreos.com/operators/prometheus
-version: 0.1.22
+version: 0.1.23
 appVersion: "0.25.0"
 home: https://github.com/coreos/prometheus-operator
 keywords:

stable/prometheus-operator/templates/_helpers.tpl

@@ -56,7 +56,7 @@ heritage: {{ .Release.Service | quote }}
 
 {{/* Create the name of prometheus-operator service account to use */}}
 {{- define "prometheus-operator.operator.serviceAccountName" -}}
-{{- if .Values.prometheusOperator.serviceAccount.create -}}
+{{- if and .Values.global.rbac.create .Values.prometheusOperator.serviceAccount.create -}}
     {{ default (include "prometheus-operator.operator.fullname" .) .Values.prometheusOperator.serviceAccount.name }}
 {{- else -}}
     {{ default "default" .Values.prometheusOperator.serviceAccount.name }}
@@ -65,7 +65,7 @@ heritage: {{ .Release.Service | quote }}
 
 {{/* Create the name of prometheus service account to use */}}
 {{- define "prometheus-operator.prometheus.serviceAccountName" -}}
-{{- if .Values.prometheus.serviceAccount.create -}}
+{{- if and .Values.global.rbac.create .Values.prometheus.serviceAccount.create -}}
     {{ default (include "prometheus-operator.prometheus.fullname" .) .Values.prometheus.serviceAccount.name }}
 {{- else -}}
     {{ default "default" .Values.prometheus.serviceAccount.name }}
@@ -74,7 +74,7 @@ heritage: {{ .Release.Service | quote }}
 
 {{/* Create the name of alertmanager service account to use */}}
 {{- define "prometheus-operator.alertmanager.serviceAccountName" -}}
-{{- if .Values.alertmanager.serviceAccount.create -}}
+{{- if and .Values.global.rbac.create .Values.alertmanager.serviceAccount.create -}}
     {{ default (include "prometheus-operator.alertmanager.fullname" .) .Values.alertmanager.serviceAccount.name }}
 {{- else -}}
     {{ default "default" .Values.alertmanager.serviceAccount.name }}

stable/prometheus-operator/templates/alertmanager/alertmanager.yaml

@@ -13,9 +13,7 @@ spec:
 {{- end }}
   replicas: {{ .Values.alertmanager.alertmanagerSpec.replicas }}
   listenLocal: {{ .Values.alertmanager.alertmanagerSpec.listenLocal }}
-{{- if .Values.global.rbac.create }}
   serviceAccountName: {{ template "prometheus-operator.alertmanager.serviceAccountName" . }}
-{{- end }}
 {{- if .Values.alertmanager.alertmanagerSpec.externalUrl }}
   externalUrl: "{{ .Values.alertmanager.alertmanagerSpec.externalUrl }}"
 {{- end }}
@@ -103,4 +101,4 @@ spec:
 {{- if .Values.alertmanager.alertmanagerSpec.additionalPeers }}
   additionalPeers: {{.Values.alertmanager.alertmanagerSpec.additionalPeers }}
 {{- end }}
-{{- end }}
+{{- end }}

stable/prometheus-operator/templates/prometheus-operator/deployment.yaml

@@ -44,9 +44,7 @@ spec:
       securityContext:
         runAsNonRoot: true
         runAsUser: 65534
-    {{- if .Values.global.rbac.create }}
       serviceAccountName: {{ template "prometheus-operator.operator.serviceAccountName" . }}
-    {{- end }}
     {{- with .Values.prometheusOperator.nodeSelector }}
       nodeSelector:
 {{ toYaml . | indent 8 }}
@@ -59,4 +57,4 @@ spec:
       tolerations:
 {{ toYaml . | indent 8 }}
     {{- end }}
-{{- end }}
+{{- end }}

stable/prometheus-operator/templates/prometheus/prometheus.yaml

@@ -64,9 +64,7 @@ spec:
   configMaps:
 {{ toYaml .Values.prometheus.prometheusSpec.configMaps | indent 4 }}
 {{- end }}
-{{- if .Values.global.rbac.create }}
   serviceAccountName: {{ template "prometheus-operator.prometheus.serviceAccountName" . }}
-{{- end }}
 {{- if .Values.prometheus.prometheusSpec.serviceMonitorSelector }}
   serviceMonitorSelector:
 {{ toYaml .Values.prometheus.prometheusSpec.serviceMonitorSelector | indent 4 }}
@@ -169,4 +167,4 @@ spec:
   thanos:
 {{ toYaml .Values.prometheus.prometheusSpec.thanos | indent 4 }}
 {{- end }}
-{{- end }}
+{{- end }}

stable/prometheus-operator/templates/prometheus/rolebinding-config.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.prometheus.enabled }}
+{{- if and .Values.prometheus.enabled .Values.global.rbac.create }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
@@ -14,4 +14,4 @@ subjects:
 - kind: ServiceAccount
   name: {{ template "prometheus-operator.prometheus.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
-{{- end }}
+{{- end }}