diff --git a/bitnami/jupyterhub/Chart.yaml b/bitnami/jupyterhub/Chart.yaml index 7ea466535e..f68d9cd4b3 100644 --- a/bitnami/jupyterhub/Chart.yaml +++ b/bitnami/jupyterhub/Chart.yaml @@ -37,4 +37,4 @@ maintainers: name: jupyterhub sources: - https://github.com/bitnami/charts/tree/main/bitnami/jupyterhub -version: 5.5.0 +version: 5.6.0 diff --git a/bitnami/jupyterhub/README.md b/bitnami/jupyterhub/README.md index adc5f0ec9b..ec1139b742 100644 --- a/bitnami/jupyterhub/README.md +++ b/bitnami/jupyterhub/README.md @@ -141,6 +141,7 @@ The command removes all the Kubernetes components associated with the chart and | `hub.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | | `hub.podSecurityContext.fsGroup` | Set Hub pod's Security Context fsGroup | `1001` | | `hub.lifecycleHooks` | LifecycleHooks for the Hub container to automate configuration before or after startup | `{}` | +| `hub.automountServiceAccountToken` | Mount Service Account token in pod | `true` | | `hub.hostAliases` | Add deployment host aliases | `[]` | | `hub.podLabels` | Add extra labels to the Hub pods | `{}` | | `hub.podAnnotations` | Add extra annotations to the Hub pods | `{}` | @@ -168,14 +169,14 @@ The command removes all the Kubernetes components associated with the chart and ### Hub RBAC parameters -| Name | Description | Value | -| ------------------------------------------------- | ---------------------------------------------------------------------- | ------ | -| `hub.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | -| `hub.serviceAccount.name` | Override Hub service account name | `""` | -| `hub.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `true` | -| `hub.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | -| `hub.rbac.create` | Specifies whether RBAC resources should be created | `true` | -| `hub.rbac.rules` | Custom RBAC rules to set | `[]` | +| Name | Description | Value | +| ------------------------------------------------- | ---------------------------------------------------------------------- | ------- | +| `hub.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `hub.serviceAccount.name` | Override Hub service account name | `""` | +| `hub.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` | +| `hub.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | +| `hub.rbac.create` | Specifies whether RBAC resources should be created | `true` | +| `hub.rbac.rules` | Custom RBAC rules to set | `[]` | ### Hub Traffic Exposure Parameters @@ -271,6 +272,7 @@ The command removes all the Kubernetes components associated with the chart and | `proxy.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` | | `proxy.podSecurityContext.fsGroup` | Set Proxy pod's Security Context fsGroup | `1001` | | `proxy.lifecycleHooks` | Add lifecycle hooks to the Proxy deployment | `{}` | +| `proxy.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `proxy.hostAliases` | Add deployment host aliases | `[]` | | `proxy.podLabels` | Add extra labels to the Proxy pods | `{}` | | `proxy.podAnnotations` | Add extra annotations to the Proxy pods | `{}` | @@ -428,6 +430,10 @@ The command removes all the Kubernetes components associated with the chart and | `imagePuller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for ImagePuller container(s) | `[]` | | `imagePuller.initContainers` | Add additional init containers to the ImagePuller pods | `[]` | | `imagePuller.sidecars` | Add additional sidecar containers to the ImagePuller pod | `[]` | +| `imagePuller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `imagePuller.serviceAccount.name` | Override image puller service account name | `""` | +| `imagePuller.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` | +| `imagePuller.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` | ### Singleuser deployment parameters @@ -440,6 +446,7 @@ The command removes all the Kubernetes components associated with the chart and | `singleuser.image.pullSecrets` | Single User image pull secrets | `[]` | | `singleuser.notebookDir` | Notebook directory (it will be the same as the PVC volume mount) | `/opt/bitnami/jupyterhub-singleuser` | | `singleuser.allowPrivilegeEscalation` | Controls whether a process can gain more privileges than its parent process | `false` | +| `singleuser.automountServiceAccountToken` | Mount Service Account token in pod | `false` | | `singleuser.command` | Override Single User default command | `[]` | | `singleuser.extraEnvVars` | Extra environment variables that should be set for the user pods | `[]` | | `singleuser.containerPort` | Single User container port | `8888` | diff --git a/bitnami/jupyterhub/templates/_helpers.tpl b/bitnami/jupyterhub/templates/_helpers.tpl index 9fe873f73e..0f2bf8af7e 100644 --- a/bitnami/jupyterhub/templates/_helpers.tpl +++ b/bitnami/jupyterhub/templates/_helpers.tpl @@ -172,6 +172,17 @@ Return the proper Docker Image Registry Secret Names list {{- include "jupyterhub.imagePullSecretsList" (dict "images" (list .Values.hub.image .Values.proxy.image .Values.auxiliaryImage) "global" .Values.global) -}} {{- end -}} +{{/* +Create the name of the service account to use +*/}} +{{- define "jupyterhub.imagePullerServiceAccountName" -}} +{{- if .Values.hub.serviceAccount.create -}} + {{ default (printf "%s-image-puller" (include "common.names.fullname" .)) .Values.imagePuller.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.imagePuller.serviceAccount.name }} +{{- end -}} +{{- end -}} + {{/* Create the name of the service account to use */}} diff --git a/bitnami/jupyterhub/templates/hub/configmap.yaml b/bitnami/jupyterhub/templates/hub/configmap.yaml index 1e22711693..979d166784 100644 --- a/bitnami/jupyterhub/templates/hub/configmap.yaml +++ b/bitnami/jupyterhub/templates/hub/configmap.yaml @@ -166,6 +166,7 @@ data: ("uid", None), ("fs_gid", None), ("service_account", "serviceAccountName"), + ("automount_service_account_token", None), ("storage_extra_labels", "storage.extraLabels"), # ("tolerations", "extraTolerations"), # Managed manually below ("node_selector", None), diff --git a/bitnami/jupyterhub/templates/hub/deployment.yaml b/bitnami/jupyterhub/templates/hub/deployment.yaml index c033d9bf9c..3a34e99bb4 100644 --- a/bitnami/jupyterhub/templates/hub/deployment.yaml +++ b/bitnami/jupyterhub/templates/hub/deployment.yaml @@ -41,6 +41,7 @@ spec: spec: serviceAccountName: {{ template "jupyterhub.hubServiceAccountName" . }} {{- include "jupyterhub.imagePullSecrets" . | nindent 6 }} + automountServiceAccountToken: {{ .Values.hub.automountServiceAccountToken }} {{- if .Values.hub.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hub.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/jupyterhub/templates/image-puller/daemonset.yaml b/bitnami/jupyterhub/templates/image-puller/daemonset.yaml index d196f6cb68..d791e7acc3 100644 --- a/bitnami/jupyterhub/templates/image-puller/daemonset.yaml +++ b/bitnami/jupyterhub/templates/image-puller/daemonset.yaml @@ -31,6 +31,8 @@ spec: app.kubernetes.io/component: image-puller spec: {{- include "jupyterhub.imagePullSecrets" . | nindent 6 }} + serviceAccountName: {{ template "jupyterhub.imagePullerServiceAccountName" . }} + automountServiceAccountToken: {{ .Values.imagePuller.automountServiceAccountToken }} {{- if .Values.imagePuller.hostAliases }} hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.hostAliases "context" $) | nindent 8 }} {{- end }} diff --git a/bitnami/jupyterhub/templates/image-puller/service-account.yaml b/bitnami/jupyterhub/templates/image-puller/service-account.yaml new file mode 100644 index 0000000000..df92c0e1af --- /dev/null +++ b/bitnami/jupyterhub/templates/image-puller/service-account.yaml @@ -0,0 +1,21 @@ +{{- /* +Copyright VMware, Inc. +SPDX-License-Identifier: APACHE-2.0 +*/}} + +{{- if .Values.imagePuller.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ template "jupyterhub.imagePullerServiceAccountName" . }} + namespace: {{ .Release.Namespace | quote }} + {{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.hub.image "chart" .Chart ) ) }} + {{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }} + labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }} + app.kubernetes.io/component: image-puller + {{- if or .Values.imagePuller.serviceAccount.annotations .Values.commonAnnotations }} + {{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.imagePuller.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }} + annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.imagePuller.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/bitnami/jupyterhub/values.yaml b/bitnami/jupyterhub/values.yaml index 0c7f63e460..85314f05b9 100644 --- a/bitnami/jupyterhub/values.yaml +++ b/bitnami/jupyterhub/values.yaml @@ -199,6 +199,7 @@ hub: containerSecurityContext: {{- omit .Values.singleuser.containerSecurityContext "enabled" | toYaml | nindent 4 }} podSecurityContext: {{- omit .Values.singleuser.podSecurityContext "enabled" | toYaml | nindent 4 }} serviceAccountName: {{ template "jupyterhub.singleuserServiceAccountName" . }} + automountServiceAccountToken: {{ .Values.singleuser.automountServiceAccountToken }} storage: {{- if .Values.singleuser.persistence.enabled }} type: dynamic @@ -383,6 +384,9 @@ hub: ## @param hub.lifecycleHooks LifecycleHooks for the Hub container to automate configuration before or after startup ## lifecycleHooks: {} + ## @param hub.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: true ## @param hub.hostAliases Add deployment host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ ## @@ -513,7 +517,7 @@ hub: ## @param hub.serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created ## Can be set to false if pods using this serviceAccount do not need to use K8s API ## - automountServiceAccountToken: true + automountServiceAccountToken: false ## @param hub.serviceAccount.annotations Additional custom annotations for the ServiceAccount ## annotations: {} @@ -822,6 +826,9 @@ proxy: lifecycleHooks: {} ## Deployment pod host aliases ## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ + ## @param proxy.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param proxy.hostAliases Add deployment host aliases ## hostAliases: [] @@ -1468,6 +1475,23 @@ imagePuller: ## containerPort: 1234 ## sidecars: [] + ## ServiceAccount parameters + ## + serviceAccount: + ## @param imagePuller.serviceAccount.create Specifies whether a ServiceAccount should be created + ## + create: true + ## @param imagePuller.serviceAccount.name Override image puller service account name + ## If not set and create is true, a name is generated using the fullname template + ## + name: "" + ## @param imagePuller.serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created + ## Can be set to false if pods using this serviceAccount do not need to use K8s API + ## + automountServiceAccountToken: false + ## @param imagePuller.serviceAccount.annotations Additional custom annotations for the ServiceAccount + ## + annotations: {} ## @section Singleuser deployment parameters ## @@ -1509,6 +1533,9 @@ singleuser: ## allowPrivilegeEscalation: false ## Command for running the container (set to default if not set). Use array form + ## @param singleuser.automountServiceAccountToken Mount Service Account token in pod + ## + automountServiceAccountToken: false ## @param singleuser.command Override Single User default command ## command: []