From f54c634d64fd5df838c3a0256c63fc5c1503424d Mon Sep 17 00:00:00 2001 From: Carlos Roberto Marques Junior Date: Wed, 4 Dec 2019 15:02:57 -0300 Subject: [PATCH] [stable/mysql] Option to create a custom service account (#19370) * option to customize securityContext Signed-off-by: Carlos Roberto Marques Junior * new line Signed-off-by: Carlos Roberto Marques Junior * [stable/mysql] option to specify serviceaccount Signed-off-by: Carlos Roberto Marques Junior --- stable/mysql/Chart.yaml | 2 +- stable/mysql/README.md | 2 ++ stable/mysql/templates/_helpers.tpl | 13 ++++++++++++- stable/mysql/templates/deployment.yaml | 1 + stable/mysql/templates/serviceaccount.yaml | 11 +++++++++++ stable/mysql/values.yaml | 10 ++++++++++ 6 files changed, 37 insertions(+), 2 deletions(-) create mode 100644 stable/mysql/templates/serviceaccount.yaml diff --git a/stable/mysql/Chart.yaml b/stable/mysql/Chart.yaml index ed4b664094..14cb2247f9 100755 --- a/stable/mysql/Chart.yaml +++ b/stable/mysql/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v1 name: mysql -version: 1.4.0 +version: 1.5.0 appVersion: 5.7.27 description: Fast, reliable, scalable, and easy to use open-source relational database system. diff --git a/stable/mysql/README.md b/stable/mysql/README.md index 8e209cd977..e5efe9c026 100755 --- a/stable/mysql/README.md +++ b/stable/mysql/README.md @@ -105,6 +105,8 @@ The following table lists the configurable parameters of the MySQL chart and the | `service.annotations` | Kubernetes annotations for mysql | {} | | `service.type` | Kubernetes service type | ClusterIP | | `service.loadBalancerIP` | LoadBalancer service IP | `""` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `false` | +| `serviceAccount.name` | The name of the ServiceAccount to create | Generated using the mysql.fullname template | | `ssl.enabled` | Setup and use SSL for MySQL connections | `false` | | `ssl.secret` | Name of the secret containing the SSL certificates | mysql-ssl-certs | | `ssl.certificates[0].name` | Name of the secret containing the SSL certificates | `nil` | diff --git a/stable/mysql/templates/_helpers.tpl b/stable/mysql/templates/_helpers.tpl index 2285e38fa4..f108425778 100644 --- a/stable/mysql/templates/_helpers.tpl +++ b/stable/mysql/templates/_helpers.tpl @@ -29,4 +29,15 @@ Generate chart secret name */}} {{- define "mysql.secretName" -}} {{ default (include "mysql.fullname" .) .Values.existingSecret }} -{{- end -}} \ No newline at end of file +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "mysql.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} +{{ default (include "mysql.fullname" .) .Values.serviceAccount.name }} +{{- else -}} +{{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} diff --git a/stable/mysql/templates/deployment.yaml b/stable/mysql/templates/deployment.yaml index e8148b1503..46714cfa3f 100644 --- a/stable/mysql/templates/deployment.yaml +++ b/stable/mysql/templates/deployment.yaml @@ -46,6 +46,7 @@ spec: fsGroup: {{ .Values.securityContext.fsGroup }} runAsUser: {{ .Values.securityContext.runAsUser }} {{- end }} + serviceAccountName: {{ template "mysql.serviceAccountName" . }} initContainers: - name: "remove-lost-found" image: "{{ .Values.busybox.image}}:{{ .Values.busybox.tag }}" diff --git a/stable/mysql/templates/serviceaccount.yaml b/stable/mysql/templates/serviceaccount.yaml new file mode 100644 index 0000000000..36ce6b3b7a --- /dev/null +++ b/stable/mysql/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "mysql.serviceAccountName" . }} + labels: + app: {{ template "mysql.fullname" . }} + chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + release: "{{ .Release.Name }}" + heritage: "{{ .Release.Service }}" +{{- end }} diff --git a/stable/mysql/values.yaml b/stable/mysql/values.yaml index 02f43b26ad..3b092fc24d 100644 --- a/stable/mysql/values.yaml +++ b/stable/mysql/values.yaml @@ -170,6 +170,16 @@ service: # nodePort: 32000 # loadBalancerIP: +## Pods Service Account +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +serviceAccount: + ## Specifies whether a ServiceAccount should be created + ## + create: false + ## The name of the ServiceAccount to use. + ## If not set and create is true, a name is generated using the mariadb.fullname template + # name: + ssl: enabled: false secret: mysql-ssl-certs