From 18506b8a92d914c054082f2112cdb5005aab2873 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Javier=20J=2E=20Salmer=C3=B3n-Garc=C3=ADa?= Date: Fri, 19 Jan 2024 10:12:48 +0100 Subject: [PATCH] [bitnami/spring-cloud-dataflow] fix: :lock: Move service-account token auto-mount to pod declaration (#22463) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Javier Salmeron Garcia Signed-off-by: Javier J. Salmerón-García --- bitnami/spring-cloud-dataflow/Chart.yaml | 2 +- bitnami/spring-cloud-dataflow/README.md | 17 ++++++++++------- .../templates/prometheus-proxy/deployment.yaml | 1 + .../templates/server/deployment.yaml | 1 + .../templates/skipper/deployment.yaml | 1 + bitnami/spring-cloud-dataflow/values.yaml | 11 ++++++++++- 6 files changed, 24 insertions(+), 9 deletions(-) diff --git a/bitnami/spring-cloud-dataflow/Chart.yaml b/bitnami/spring-cloud-dataflow/Chart.yaml index 15c90ee87e..c0d6c1f57b 100644 --- a/bitnami/spring-cloud-dataflow/Chart.yaml +++ b/bitnami/spring-cloud-dataflow/Chart.yaml @@ -53,4 +53,4 @@ maintainers: name: spring-cloud-dataflow sources: - https://github.com/bitnami/charts/tree/main/bitnami/spring-cloud-dataflow -version: 26.3.1 +version: 26.4.0 diff --git a/bitnami/spring-cloud-dataflow/README.md b/bitnami/spring-cloud-dataflow/README.md index b4b355487d..c11ff91fd7 100644 --- a/bitnami/spring-cloud-dataflow/README.md +++ b/bitnami/spring-cloud-dataflow/README.md @@ -80,6 +80,7 @@ helm uninstall my-release | `server.image.pullPolicy` | Spring Cloud Dataflow image pull policy | `IfNotPresent` | | `server.image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | | `server.image.debug` | Enable image debug mode | `false` | +| `server.automountServiceAccountToken` | Mount Service Account token in pod | `true` | | `server.hostAliases` | Deployment pod host aliases | `[]` | | `server.composedTaskRunner.image.registry` | Spring Cloud Dataflow Composed Task Runner image registry | `REGISTRY_NAME` | | `server.composedTaskRunner.image.repository` | Spring Cloud Dataflow Composed Task Runner image repository | `REPOSITORY_NAME/spring-cloud-dataflow-composed-task-runner` | @@ -199,6 +200,7 @@ helm uninstall my-release | Name | Description | Value | | ----------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | -------------------------------------- | | `skipper.enabled` | Enable Spring Cloud Skipper component | `true` | +| `skipper.automountServiceAccountToken` | Mount Service Account token in pod | `true` | | `skipper.hostAliases` | Deployment pod host aliases | `[]` | | `skipper.image.registry` | Spring Cloud Skipper image registry | `REGISTRY_NAME` | | `skipper.image.repository` | Spring Cloud Skipper image repository | `REPOSITORY_NAME/spring-cloud-skipper` | @@ -317,13 +319,13 @@ helm uninstall my-release ### RBAC parameters -| Name | Description | Value | -| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------ | -| `serviceAccount.create` | Enable the creation of a ServiceAccount for Dataflow server and Skipper server pods | `true` | -| `serviceAccount.name` | Name of the created serviceAccount. If not set and create is true, a name is generated using the scdf.fullname template | `""` | -| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | -| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | -| `rbac.create` | Whether to create and use RBAC resources or not | `true` | +| Name | Description | Value | +| --------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | ------- | +| `serviceAccount.create` | Enable the creation of a ServiceAccount for Dataflow server and Skipper server pods | `true` | +| `serviceAccount.name` | Name of the created serviceAccount. If not set and create is true, a name is generated using the scdf.fullname template | `""` | +| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `false` | +| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | +| `rbac.create` | Whether to create and use RBAC resources or not | `true` | ### Metrics parameters @@ -345,6 +347,7 @@ helm uninstall my-release | `metrics.nodeAffinityPreset.values` | Prometheus Rsocket Proxy node label values to match. Ignored if `metrics.affinity` is set. | `[]` | | `metrics.affinity` | Prometheus Rsocket Proxy affinity for pod assignment | `{}` | | `metrics.nodeSelector` | Prometheus Rsocket Proxy node labels for pod assignment | `{}` | +| `metrics.automountServiceAccountToken` | Mount Service Account token in pod | `true` | | `metrics.hostAliases` | Prometheus Proxy pods host aliases | `[]` | | `metrics.tolerations` | Prometheus Rsocket Proxy tolerations for pod assignment | `[]` | | `metrics.podAnnotations` | Annotations for Prometheus Rsocket Proxy pods | `{}` | diff --git a/bitnami/spring-cloud-dataflow/templates/prometheus-proxy/deployment.yaml b/bitnami/spring-cloud-dataflow/templates/prometheus-proxy/deployment.yaml index 0aaf9234e0..c957547def 100644 --- a/bitnami/spring-cloud-dataflow/templates/prometheus-proxy/deployment.yaml +++ b/bitnami/spring-cloud-dataflow/templates/prometheus-proxy/deployment.yaml @@ -33,6 +33,7 @@ spec: spec: {{- include "scdf.imagePullSecrets" . | nindent 6 }} serviceAccountName: {{ include "scdf.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.metrics.automountServiceAccountToken }} {{- if .Values.metrics.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.metrics.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/spring-cloud-dataflow/templates/server/deployment.yaml b/bitnami/spring-cloud-dataflow/templates/server/deployment.yaml index 241bd45e53..ac39e27006 100644 --- a/bitnami/spring-cloud-dataflow/templates/server/deployment.yaml +++ b/bitnami/spring-cloud-dataflow/templates/server/deployment.yaml @@ -43,6 +43,7 @@ spec: spec: {{- include "scdf.imagePullSecrets" . | nindent 6 }} serviceAccountName: {{ include "scdf.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.server.automountServiceAccountToken }} {{- if .Values.server.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.server.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/spring-cloud-dataflow/templates/skipper/deployment.yaml b/bitnami/spring-cloud-dataflow/templates/skipper/deployment.yaml index 3559de5d77..ec589446a1 100644 --- a/bitnami/spring-cloud-dataflow/templates/skipper/deployment.yaml +++ b/bitnami/spring-cloud-dataflow/templates/skipper/deployment.yaml @@ -41,6 +41,7 @@ spec: spec: {{- include "scdf.imagePullSecrets" . | nindent 6 }} serviceAccountName: {{ include "scdf.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.skipper.automountServiceAccountToken }} {{- if .Values.skipper.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.skipper.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/spring-cloud-dataflow/values.yaml b/bitnami/spring-cloud-dataflow/values.yaml index b5bc0a48d2..1e9906494f 100644 --- a/bitnami/spring-cloud-dataflow/values.yaml +++ b/bitnami/spring-cloud-dataflow/values.yaml @@ -78,6 +78,9 @@ server: ## Set to true if you would like to see extra information on logs ## debug: false + ## @param server.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: true ## @param server.hostAliases Deployment pod host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -601,6 +604,9 @@ skipper: ## Note: it'll be also enabled if streams are enabled in Dataflow server configuration. ## enabled: true + ## @param skipper.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: true ## @param skipper.hostAliases Deployment pod host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -1079,7 +1085,7 @@ deployer: serviceAccount: create: true name: "" - automountServiceAccountToken: true + automountServiceAccountToken: false annotations: {} ## Role Based Access ## ref: https://kubernetes.io/docs/admin/authorization/rbac/ @@ -1184,6 +1190,9 @@ metrics: ## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ ## nodeSelector: {} + ## @param metrics.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: true ## @param metrics.hostAliases Prometheus Proxy pods host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ##