[stable/postgresql] Add service account support (#13751)

* Add service account support

Service account utilization is optional and not activated by default.

Signed-off-by: Dennis Effing <dennis.effing@codecentric.de>

* Remove trailing spaces

Signed-off-by: Dennis Effing <dennis.effing@codecentric.de>

* Add missing documentation on serviceAccount.name property

Signed-off-by: Dennis Effing <dennis.effing@codecentric.de>

* Add service account properties to production values

Signed-off-by: Dennis Effing <dennis.effing@codecentric.de>

stable/postgresql/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 name: postgresql
-version: 4.1.0
+version: 4.2.0
 appVersion: 10.8.0
 description: Chart for PostgreSQL, an object-relational database management system (ORDBMS) with an emphasis on extensibility and on standards-compliance.
 keywords:

stable/postgresql/README.md

@@ -117,6 +117,8 @@ The following tables lists the configurable parameters of the PostgreSQL chart a
 | `securityContext.enabled`                     | Enable security context                                                                                                | `true`                                                      |
 | `securityContext.fsGroup`                     | Group ID for the container                                                                                             | `1001`                                                      |
 | `securityContext.runAsUser`                   | User ID for the container                                                                                              | `1001`                                                      |
+| `serviceAccount.enabled`                      | Enable service account (Note: Service Account will only be automatically created if `serviceAccount.name` is not set)  | `false`                                                     |
+| `serviceAcccount.name`                        | Name of existing service account                                                                                       | `nil`                                                       |
 | `livenessProbe.enabled`                       | Would you like a livessProbed to be enabled                                                                            | `true`                                                      |
 | `networkPolicy.enabled`                       | Enable NetworkPolicy                                                                                                   | `false`                                                     |
 | `networkPolicy.allowExternal`                 | Don't require client label for connections                                                                             | `true`                                                      |

stable/postgresql/templates/serviceaccount.yaml

@@ -0,0 +1,11 @@
+{{- if and (.Values.serviceAccount.enabled) (not .Values.serviceAccount.name) }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app: {{ template "postgresql.name" . }}
+    chart: {{ template "postgresql.chart" . }}
+    release: {{ .Release.Name | quote }}
+    heritage: {{ .Release.Service | quote }}
+  name: {{ template "postgresql.fullname" . }}
+{{- end }}

stable/postgresql/templates/statefulset-slaves.yaml

@@ -53,6 +53,9 @@ spec:
       securityContext:
         fsGroup: {{ .Values.securityContext.fsGroup }}
       {{- end }}
+      {{- if .Values.serviceAccount.enabled }}
+      serviceAccountName: {{ default (include "postgresql.fullname" . ) .Values.serviceAccount.name}}
+      {{- end }}
       {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
       initContainers:
       - name: init-chmod-data

stable/postgresql/templates/statefulset.yaml

@@ -57,6 +57,9 @@ spec:
       securityContext:
         fsGroup: {{ .Values.securityContext.fsGroup }}      
       {{- end }}
+      {{- if .Values.serviceAccount.enabled }}
+      serviceAccountName: {{ default (include "postgresql.fullname" . ) .Values.serviceAccount.name }}
+      {{- end }}
       {{- if and .Values.volumePermissions.enabled .Values.persistence.enabled }}
       initContainers:
       - name: init-chmod-data

stable/postgresql/values-production.yaml

@@ -65,6 +65,13 @@ securityContext:
   fsGroup: 1001
   runAsUser: 1001
 
+## Pod Service Account
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+serviceAccount:
+  enabled: false
+  ## Name of an already existing service account. Setting this value disables the automatic service account creation.
+  # name:
+
 replication:
   enabled: true
   user: repl_user

stable/postgresql/values.yaml

@@ -65,6 +65,13 @@ securityContext:
   fsGroup: 1001
   runAsUser: 1001
 
+## Pod Service Account
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+serviceAccount:
+  enabled: false
+  ## Name of an already existing service account. Setting this value disables the automatic service account creation.
+  # name:
+
 replication:
   enabled: false
   user: repl_user