github/deprecated-helm-charts
1
0
Fork 0
mirror of https://github.com/helm/charts.git synced 2026-08-22 13:57:51 +00:00
Code Issues Packages Projects Releases Wiki Activity

[incubator/aws-alb-ingress-controller] reuse existing service account (#21718)

Browse Source 
* modify aws-alb-ingress-controller for reuse sa

Signed-off-by: cw-sakamoto <sakamoto@chatwork.com>

* add security context for aws-alb-ingress-controller

Signed-off-by: cw-sakamoto <sakamoto@chatwork.com>

* Update chart aws-alb-ingress-controller

Signed-off-by: cw-sakamoto <sakamoto@chatwork.com>
This commit is contained in:
Ryo Sakamoto
2020-04-14 11:02:13 -07:00
committed by GitHub
parent 843445e462
commit e266a69f6f
7 changed files with 63 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
incubator/aws-alb-ingress-controller/Chart.yaml
+1 -1
View File
@@ -1,7 +1,7 @@
apiVersion: v1
name: aws-alb-ingress-controller
description: A Helm chart for AWS ALB Ingress Controller
version: 0.1.14
version: 1.0.0
appVersion: "v1.1.6"
engine: gotpl
home: https://github.com/kubernetes-sigs/aws-alb-ingress-controller
incubator/aws-alb-ingress-controller/README.md
+5 -2
View File
@@ -69,8 +69,11 @@ The following tables lists the configurable parameters of the alb-ingress-contro
| `priorityClassName` | set to ensure your pods survive resource shortages | `""` |
| `resources` | controller pod resource requests & limits | `{}` |
| `rbac.create` | If true, create & use RBAC resources | `true` |
| `rbac.serviceAccountName` | ServiceAccount ALB ingress controller will use (ignored if rbac.create=true) | `default` |
| `rbac.serviceAccountAnnotations` | Service Account annotations | `{}` |
| `rbac.serviceAccount.name` | existing ServiceAccount to use (ignored if rbac.create=true and rbac.serviceAccount.create=true) | `default` |
| `rbac.serviceAccount.create` | If true and rbac.create is also true, a service account will be created | `true` |
| `rbac.serviceAccount.annotations` | Service Account annotations | `{}` |
| `securityContext` | set to security context for pod | `{}` |
| `containerSecurityContext` | set to security context for container | `{}` |
| `scope.ingressClass` | If provided, the ALB ingress controller will only act on Ingress resources annotated with this class | `alb` |
| `scope.singleNamespace` | If true, the ALB ingress controller will only act on Ingress resources in a single namespace | `false` (watch all namespaces) |
| `scope.watchNamespace` | If scope.singleNamespace=true, the ALB ingress controller will only act on Ingress resources in this namespace | `""` (namespace of the ALB ingress controller) |
incubator/aws-alb-ingress-controller/templates/_helpers.tpl
+11
View File
@@ -30,3 +30,14 @@ Create chart name and version as used by the chart label.
{{- define "aws-alb-ingress-controller.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
{{- end -}}
{{/*
Return the service account name used by the pod.
*/}}
{{- define "serviceaccount.name" -}}
{{- if and .Values.rbac.create .Values.rbac.serviceAccount.create -}}
{{ include "aws-alb-ingress-controller.fullname" . }}
{{- else -}}
{{ .Values.rbac.serviceAccount.name }}
{{- end -}}
{{- end -}}
incubator/aws-alb-ingress-controller/templates/clusterrolebinding.yaml
+1 -1
View File
@@ -14,6 +14,6 @@ roleRef:
name: {{ include "aws-alb-ingress-controller.fullname" . }}
subjects:
- kind: ServiceAccount
name: {{ include "aws-alb-ingress-controller.fullname" . }}
name: {{ include "serviceaccount.name" . }}
namespace: {{ .Release.Namespace }}
{{- end }}
incubator/aws-alb-ingress-controller/templates/deployment.yaml
+28 -31
View File
@@ -18,16 +18,13 @@ spec:
labels:
app.kubernetes.io/name: {{ include "aws-alb-ingress-controller.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- if .Values.podLabels }}
{{ toYaml .Values.podLabels | indent 8}}
{{- end }}
{{- if .Values.podAnnotations }}
annotations:
{{ toYaml .Values.podAnnotations | indent 8}}
{{- with .Values.podLabels }}{{ toYaml . | nindent 8 }}{{- end }}
{{- with .Values.podAnnotations }}
annotations: {{ toYaml . | nindent 8 }}
{{- end }}
spec:
{{- if .Values.priorityClassName }}
priorityClassName: "{{ .Values.priorityClassName }}"
{{- with .Values.priorityClassName }}
priorityClassName: "{{ . }}"
{{- end }}
containers:
- name: {{ .Chart.Name }}
@@ -35,8 +32,8 @@ spec:
imagePullPolicy: {{ .Values.image.pullPolicy }}
args:
- --cluster-name={{ required "specify clusterName via --set clusterName=YourClusterName" .Values.clusterName }}
{{- if .Values.scope.ingressClass }}
- --ingress-class={{ .Values.scope.ingressClass }}
{{- with .Values.scope.ingressClass }}
- --ingress-class={{ . }}
{{- end }}
{{- if .Values.scope.singleNamespace }}
- --watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }}
@@ -79,27 +76,27 @@ spec:
periodSeconds: 60
timeoutSeconds: {{ .Values.livenessProbeTimeout }}
{{- end }}
resources:
{{ toYaml .Values.resources | indent 12 }}
resources: {{ toYaml .Values.resources | nindent 12 }}
{{- with .Values.volumeMounts }}
volumeMounts:
{{ toYaml . | indent 12 }}
volumeMounts: {{ toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{ toYaml . | indent 8 }}
{{- end }}
{{- with .Values.volumes }}
volumes:
{{ toYaml . | indent 8 }}
{{- end }}
serviceAccountName: {{ if .Values.rbac.create }}{{ include "aws-alb-ingress-controller.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }}
{{- with .Values.containerSecurityContext }}
securityContext: {{ toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector: {{ toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.affinity }}
affinity: {{ toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations: {{ toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.volumes }}
volumes: {{ toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ template "serviceaccount.name" . }}
{{- with .Values.securityContext }}
securityContext: {{ toYaml . | nindent 8 }}
{{- end }}
terminationGracePeriodSeconds: 60
incubator/aws-alb-ingress-controller/templates/serviceaccount.yaml
+3 -3
View File
@@ -1,14 +1,14 @@
{{- if .Values.rbac.create }}
{{- if and .Values.rbac.create .Values.rbac.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "aws-alb-ingress-controller.fullname" . }}
name: {{ template "serviceaccount.name" . }}
labels:
app.kubernetes.io/name: {{ include "aws-alb-ingress-controller.name" . }}
helm.sh/chart: {{ include "aws-alb-ingress-controller.chart" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- with .Values.rbac.serviceAccountAnnotations }}
{{- with .Values.rbac.serviceAccount.annotations }}
annotations: {{ toYaml . | nindent 4 }}
{{- end }}
{{- end }}
incubator/aws-alb-ingress-controller/values.yaml
+14 -3
View File
@@ -70,9 +70,12 @@ rbac:
## If true, create & use RBAC resources
##
create: true
serviceAccountName: default
## Annotations for the Service Account
serviceAccountAnnotations: {}
serviceAccount:
create: true
name: default
## Annotations for the Service Account
annotations: {}
image:
repository: docker.io/amazon/aws-alb-ingress-controller
@@ -119,3 +122,11 @@ volumes: []
# ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
# PriorityClass: system-cluster-critical
priorityClassName: ""
# Security Context
# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
# for Pod
securityContext: {}
# for Container
containerSecurityContext: {}