From e266a69f6f76e19d73db426ea4cf2df28cf1189e Mon Sep 17 00:00:00 2001 From: Ryo Sakamoto Date: Wed, 15 Apr 2020 03:02:13 +0900 Subject: [PATCH] [incubator/aws-alb-ingress-controller] reuse existing service account (#21718) * modify aws-alb-ingress-controller for reuse sa Signed-off-by: cw-sakamoto * add security context for aws-alb-ingress-controller Signed-off-by: cw-sakamoto * Update chart aws-alb-ingress-controller Signed-off-by: cw-sakamoto --- .../aws-alb-ingress-controller/Chart.yaml | 2 +- .../aws-alb-ingress-controller/README.md | 7 ++- .../templates/_helpers.tpl | 11 ++++ .../templates/clusterrolebinding.yaml | 2 +- .../templates/deployment.yaml | 59 +++++++++---------- .../templates/serviceaccount.yaml | 6 +- .../aws-alb-ingress-controller/values.yaml | 17 +++++- 7 files changed, 63 insertions(+), 41 deletions(-) diff --git a/incubator/aws-alb-ingress-controller/Chart.yaml b/incubator/aws-alb-ingress-controller/Chart.yaml index 6a7782fbbf..911e250682 100644 --- a/incubator/aws-alb-ingress-controller/Chart.yaml +++ b/incubator/aws-alb-ingress-controller/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: aws-alb-ingress-controller description: A Helm chart for AWS ALB Ingress Controller -version: 0.1.14 +version: 1.0.0 appVersion: "v1.1.6" engine: gotpl home: https://github.com/kubernetes-sigs/aws-alb-ingress-controller diff --git a/incubator/aws-alb-ingress-controller/README.md b/incubator/aws-alb-ingress-controller/README.md index 15ceb93364..90920cd4fa 100644 --- a/incubator/aws-alb-ingress-controller/README.md +++ b/incubator/aws-alb-ingress-controller/README.md @@ -69,8 +69,11 @@ The following tables lists the configurable parameters of the alb-ingress-contro | `priorityClassName` | set to ensure your pods survive resource shortages | `""` | | `resources` | controller pod resource requests & limits | `{}` | | `rbac.create` | If true, create & use RBAC resources | `true` | -| `rbac.serviceAccountName` | ServiceAccount ALB ingress controller will use (ignored if rbac.create=true) | `default` | -| `rbac.serviceAccountAnnotations` | Service Account annotations | `{}` | +| `rbac.serviceAccount.name` | existing ServiceAccount to use (ignored if rbac.create=true and rbac.serviceAccount.create=true) | `default` | +| `rbac.serviceAccount.create` | If true and rbac.create is also true, a service account will be created | `true` | +| `rbac.serviceAccount.annotations` | Service Account annotations | `{}` | +| `securityContext` | set to security context for pod | `{}` | +| `containerSecurityContext` | set to security context for container | `{}` | | `scope.ingressClass` | If provided, the ALB ingress controller will only act on Ingress resources annotated with this class | `alb` | | `scope.singleNamespace` | If true, the ALB ingress controller will only act on Ingress resources in a single namespace | `false` (watch all namespaces) | | `scope.watchNamespace` | If scope.singleNamespace=true, the ALB ingress controller will only act on Ingress resources in this namespace | `""` (namespace of the ALB ingress controller) | diff --git a/incubator/aws-alb-ingress-controller/templates/_helpers.tpl b/incubator/aws-alb-ingress-controller/templates/_helpers.tpl index 7eb0c6eaab..619d7f5a50 100644 --- a/incubator/aws-alb-ingress-controller/templates/_helpers.tpl +++ b/incubator/aws-alb-ingress-controller/templates/_helpers.tpl @@ -30,3 +30,14 @@ Create chart name and version as used by the chart label. {{- define "aws-alb-ingress-controller.chart" -}} {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} {{- end -}} + +{{/* +Return the service account name used by the pod. +*/}} +{{- define "serviceaccount.name" -}} +{{- if and .Values.rbac.create .Values.rbac.serviceAccount.create -}} +{{ include "aws-alb-ingress-controller.fullname" . }} +{{- else -}} +{{ .Values.rbac.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/incubator/aws-alb-ingress-controller/templates/clusterrolebinding.yaml b/incubator/aws-alb-ingress-controller/templates/clusterrolebinding.yaml index d0130e06f8..2cec26cc88 100644 --- a/incubator/aws-alb-ingress-controller/templates/clusterrolebinding.yaml +++ b/incubator/aws-alb-ingress-controller/templates/clusterrolebinding.yaml @@ -14,6 +14,6 @@ roleRef: name: {{ include "aws-alb-ingress-controller.fullname" . }} subjects: - kind: ServiceAccount - name: {{ include "aws-alb-ingress-controller.fullname" . }} + name: {{ include "serviceaccount.name" . }} namespace: {{ .Release.Namespace }} {{- end }} diff --git a/incubator/aws-alb-ingress-controller/templates/deployment.yaml b/incubator/aws-alb-ingress-controller/templates/deployment.yaml index 5602d00c4e..74af52e98a 100644 --- a/incubator/aws-alb-ingress-controller/templates/deployment.yaml +++ b/incubator/aws-alb-ingress-controller/templates/deployment.yaml @@ -18,16 +18,13 @@ spec: labels: app.kubernetes.io/name: {{ include "aws-alb-ingress-controller.name" . }} app.kubernetes.io/instance: {{ .Release.Name }} - {{- if .Values.podLabels }} -{{ toYaml .Values.podLabels | indent 8}} - {{- end }} - {{- if .Values.podAnnotations }} - annotations: -{{ toYaml .Values.podAnnotations | indent 8}} + {{- with .Values.podLabels }}{{ toYaml . | nindent 8 }}{{- end }} + {{- with .Values.podAnnotations }} + annotations: {{ toYaml . | nindent 8 }} {{- end }} spec: - {{- if .Values.priorityClassName }} - priorityClassName: "{{ .Values.priorityClassName }}" + {{- with .Values.priorityClassName }} + priorityClassName: "{{ . }}" {{- end }} containers: - name: {{ .Chart.Name }} @@ -35,8 +32,8 @@ spec: imagePullPolicy: {{ .Values.image.pullPolicy }} args: - --cluster-name={{ required "specify clusterName via --set clusterName=YourClusterName" .Values.clusterName }} - {{- if .Values.scope.ingressClass }} - - --ingress-class={{ .Values.scope.ingressClass }} + {{- with .Values.scope.ingressClass }} + - --ingress-class={{ . }} {{- end }} {{- if .Values.scope.singleNamespace }} - --watch-namespace={{ default .Release.Namespace .Values.scope.watchNamespace }} @@ -79,27 +76,27 @@ spec: periodSeconds: 60 timeoutSeconds: {{ .Values.livenessProbeTimeout }} {{- end }} - resources: -{{ toYaml .Values.resources | indent 12 }} + resources: {{ toYaml .Values.resources | nindent 12 }} {{- with .Values.volumeMounts }} - volumeMounts: -{{ toYaml . | indent 12 }} + volumeMounts: {{ toYaml . | nindent 12 }} {{- end }} - {{- with .Values.nodeSelector }} - nodeSelector: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.affinity }} - affinity: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.tolerations }} - tolerations: -{{ toYaml . | indent 8 }} - {{- end }} - {{- with .Values.volumes }} - volumes: -{{ toYaml . | indent 8 }} - {{- end }} - serviceAccountName: {{ if .Values.rbac.create }}{{ include "aws-alb-ingress-controller.fullname" . }}{{ else }}"{{ .Values.rbac.serviceAccountName }}"{{ end }} + {{- with .Values.containerSecurityContext }} + securityContext: {{ toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: {{ toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.volumes }} + volumes: {{ toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ template "serviceaccount.name" . }} + {{- with .Values.securityContext }} + securityContext: {{ toYaml . | nindent 8 }} + {{- end }} terminationGracePeriodSeconds: 60 diff --git a/incubator/aws-alb-ingress-controller/templates/serviceaccount.yaml b/incubator/aws-alb-ingress-controller/templates/serviceaccount.yaml index 337446b67b..00dc274d59 100644 --- a/incubator/aws-alb-ingress-controller/templates/serviceaccount.yaml +++ b/incubator/aws-alb-ingress-controller/templates/serviceaccount.yaml @@ -1,14 +1,14 @@ -{{- if .Values.rbac.create }} +{{- if and .Values.rbac.create .Values.rbac.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "aws-alb-ingress-controller.fullname" . }} + name: {{ template "serviceaccount.name" . }} labels: app.kubernetes.io/name: {{ include "aws-alb-ingress-controller.name" . }} helm.sh/chart: {{ include "aws-alb-ingress-controller.chart" . }} app.kubernetes.io/instance: {{ .Release.Name }} app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- with .Values.rbac.serviceAccountAnnotations }} +{{- with .Values.rbac.serviceAccount.annotations }} annotations: {{ toYaml . | nindent 4 }} {{- end }} {{- end }} diff --git a/incubator/aws-alb-ingress-controller/values.yaml b/incubator/aws-alb-ingress-controller/values.yaml index 9a81612990..bc138b43a0 100644 --- a/incubator/aws-alb-ingress-controller/values.yaml +++ b/incubator/aws-alb-ingress-controller/values.yaml @@ -70,9 +70,12 @@ rbac: ## If true, create & use RBAC resources ## create: true - serviceAccountName: default - ## Annotations for the Service Account - serviceAccountAnnotations: {} + serviceAccount: + create: true + name: default + + ## Annotations for the Service Account + annotations: {} image: repository: docker.io/amazon/aws-alb-ingress-controller @@ -119,3 +122,11 @@ volumes: [] # ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ # PriorityClass: system-cluster-critical priorityClassName: "" + +# Security Context +# ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ +# for Pod +securityContext: {} + +# for Container +containerSecurityContext: {}