Add support for ServiceAccount (#19586)

AWS EKS supports IAM roles via ServiceAccounts.

Signed-off-by: Mikko Kokkonen <mikko@mikian.com>

stable/sentry/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 description: Sentry is a cross-platform crash reporting and aggregation platform.
 name: sentry
-version: 3.1.6
+version: 3.1.7
 appVersion: 9.1.2
 keywords:
   - debugging

stable/sentry/README.md

@@ -171,6 +171,9 @@ Parameter                                            | Description
 `hooks.affinity`                                     | Affinity settings for hooks pods                                                                           | `{}`
 `hooks.dbInit.resources.limits`                      | Hook job resource limits                                                                                   | `{memory: 3200Mi}`
 `hooks.dbInit.resources.requests`                    | Hook job resource requests                                                                                 | `{memory: 3000Mi}`
+`serviceAccount.name`                                | name of the ServiceAccount to be used by access-controlled resources | autogenerated
+`serviceAccount.create`                              | Configures if a ServiceAccount with this name should be created | `true`
+`serviceAccount.annotations`                         | Configures annotation for the ServiceAccount | `{}`
 
 Dependent charts can also have values overwritten. Preface values with postgresql. _or redis._
 

stable/sentry/templates/_helpers.tpl

@@ -121,3 +121,14 @@ Set redis port
 {{- default "6379" .Values.redis.port | quote -}}
 {{- end -}}
 {{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "sentry.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "sentry.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

stable/sentry/templates/configmap.yaml

@@ -76,13 +76,27 @@ data:
     {{ end }}
     {{- if eq .Values.filestore.backend "s3" }}
     filestore.options:
+      {{- if .Values.filestore.s3.accessKey }}
       access_key: '{{ .Values.filestore.s3.accessKey }}'
+      {{- end }}
+      {{- if .Values.filestore.s3.secretKey }}
       secret_key: '{{ .Values.filestore.s3.secretKey }}'
+      {{- end }}
+      {{- if .Values.filestore.s3.bucketName }}
       bucket_name: '{{ .Values.filestore.s3.bucketName }}'
+      {{- end }}
+      {{- if .Values.filestore.s3.endpointUrl }}
       endpoint_url: '{{ .Values.filestore.s3.endpointUrl }}'
+      {{- end }}
+      {{- if .Values.filestore.s3.signature_version }}
       signature_version: '{{ .Values.filestore.s3.signature_version }}'
+      {{- end }}
+      {{- if .Values.filestore.s3.region_name }}
       region_name: '{{ .Values.filestore.s3.region_name }}'
+      {{- end }}
+      {{- if .Values.filestore.s3.default_acl }}
       default_acl: '{{ .Values.filestore.s3.default_acl }}'
+      {{- end }}
     {{ end }}
 
 {{ .Values.config.configYml | indent 4 }}
@@ -401,7 +415,7 @@ data:
         'SENTRY_VSTS_CLIENT_ID': 'vsts.client-id',
         'SENTRY_VSTS_CLIENT_SECRET': 'vsts.client-secret',
         'GOOGLE_CLIENT_ID': 'auth-google.client-id',
-        'GOOGLE_CLIENT_SECRET': 'auth-google.client-secret',    
+        'GOOGLE_CLIENT_SECRET': 'auth-google.client-secret',
     }
 
 
@@ -465,6 +479,6 @@ data:
         'host': '{{ template "sentry.fullname" . }}-metrics',
         'port': 9125,
     }
-{{- end }} 
+{{- end }}
 
 {{ .Values.config.sentryConfPy | indent 4 }}

stable/sentry/templates/cron-deployment.yaml

@@ -32,6 +32,7 @@ spec:
 {{ toYaml .Values.cron.podLabels | indent 8 }}
         {{- end }}
     spec:
+      serviceAccountName: {{ template "sentry.serviceAccountName" . }}
       {{- if .Values.cron.affinity }}
       affinity:
 {{ toYaml .Values.cron.affinity | indent 8 }}

stable/sentry/templates/serviceaccount.yaml

@@ -0,0 +1,14 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "sentry.serviceAccountName" . }}
+  labels:
+    app: {{ template "sentry.fullname" . }}
+    chart: "{{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}"
+    release: "{{ .Release.Name }}"
+    heritage: "{{ .Release.Service }}"
+  {{- if .Values.serviceAccount.annotations }}
+  annotations: {{ toYaml .Values.serviceAccount.annotations | nindent 4 }}
+  {{- end }}
+{{- end -}}

stable/sentry/templates/web-deployment.yaml

@@ -32,6 +32,7 @@ spec:
 {{ toYaml .Values.web.podLabels | indent 8 }}
         {{- end }}
     spec:
+      serviceAccountName: {{ template "sentry.serviceAccountName" . }}
       {{- if .Values.web.affinity }}
       affinity:
 {{ toYaml .Values.web.affinity | indent 8 }}

stable/sentry/templates/workers-deployment.yaml

@@ -32,6 +32,7 @@ spec:
 {{ toYaml .Values.worker.podLabels | indent 8 }}
         {{- end }}
     spec:
+      serviceAccountName: {{ template "sentry.serviceAccountName" . }}
       {{- if .Values.worker.affinity }}
       affinity:
 {{ toYaml .Values.worker.affinity | indent 8 }}

stable/sentry/values.yaml

@@ -287,3 +287,11 @@ hooks:
         memory: 3200Mi
       requests:
         memory: 3000Mi
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name:
+  annotations: {}