Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/metrics-server] fix: 🔒 Move service-account token auto-mount to pod declaration (#22433)

Browse Source 
* [bitnami/metrics-server] fix: 🔒 Move service-account token auto-mount to pod declaration

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* test: ✅ Update goss test to reflect new value

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

---------

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-19 11:55:30 +01:00
committed by GitHub
parent 4ddb669f0c
commit 2c3ab4db18
6 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.vib/metrics-server/goss/goss.yaml
+1 -1
View File
@@ -14,7 +14,7 @@ command:
# or the one randomly defined by openshift (larger values). Otherwise, the chart is still using the default value.
exec: if [ $(id -u) -lt {{ $uid }} ]; then exit 1; fi
exit-status: 0
{{ if .Vars.serviceAccount.automountServiceAccountToken }}
{{ if .Vars.automountServiceAccountToken }}
check-sa:
exec: cat /var/run/secrets/kubernetes.io/serviceaccount/token | cut -d '.' -f 2 | xargs -I '{}' echo '{}====' | fold -w 4 | sed '$ d' | tr -d '\n' | base64 -d
exit-status: 0
.vib/metrics-server/runtime-parameters.yaml
+1 -1
View File
@@ -1,6 +1,6 @@
serviceAccount:
create: true
automountServiceAccountToken: true
automountServiceAccountToken: true
extraArgs:
- --authorization-always-allow-paths=/metrics
- --kubelet-insecure-tls=true
bitnami/metrics-server/Chart.yaml
+1 -1
View File
@@ -28,4 +28,4 @@ maintainers:
name: metrics-server
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/metrics-server
version: 6.7.1
version: 6.8.0
bitnami/metrics-server/README.md
+2 -1
View File
@@ -84,13 +84,14 @@ The command removes all the Kubernetes components associated with the chart and
| `image.digest` | Metrics Server image digest in the way sha256:aa.... Please note this parameter, if set, will override the tag | `""` |
| `image.pullPolicy` | Metrics Server image pull policy | `IfNotPresent` |
| `image.pullSecrets` | Metrics Server image pull secrets | `[]` |
| `automountServiceAccountToken` | Mount Service Account token in pod | `true` |
| `hostAliases` | Add deployment host aliases | `[]` |
| `replicas` | Number of metrics-server nodes to deploy | `1` |
| `updateStrategy.type` | Set up update strategy for metrics-server installation. | `RollingUpdate` |
| `rbac.create` | Enable RBAC authentication | `true` |
| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `serviceAccount.name` | The name of the ServiceAccount to create | `""` |
| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account | `true` |
| `serviceAccount.automountServiceAccountToken` | Automount API credentials for a service account | `false` |
| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` |
| `apiService.create` | Specifies whether the v1beta1.metrics.k8s.io API service should be created. You can check if it is needed with `kubectl get --raw "/apis/metrics.k8s.io/v1beta1/nodes"`. | `false` |
| `apiService.insecureSkipTLSVerify` | Specifies whether to skip self-verifying self-signed TLS certificates. Set to "false" if you are providing your own certificates. | `true` |
bitnami/metrics-server/templates/deployment.yaml
+1
View File
@@ -49,6 +49,7 @@ spec:
{{- if .Values.nodeSelector }}
nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }}
{{- end }}
automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
{{- if .Values.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/metrics-server/values.yaml
+4 -1
View File
@@ -85,6 +85,9 @@ image:
##
pullSecrets: []
## @param automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: true
## @param hostAliases Add deployment host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -124,7 +127,7 @@ serviceAccount:
## @param serviceAccount.automountServiceAccountToken Automount API credentials for a service account
## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server
##
automountServiceAccountToken: true
automountServiceAccountToken: false
## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`.
##
annotations: {}