Bitnami/charts
2
0
Fork 0
mirror of https://github.com/bitnami/charts.git synced 2026-08-10 14:15:55 +08:00
Code Issues Packages Projects Releases Wiki Activity

[bitnami/jupyterhub] fix: 🔒 Move service-account token auto-mount to pod declaration (#22414)

Browse Source 
* [bitnami/jupyterhub] fix: 🔒 Move service-account token auto-mount to pod declaration

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* fix: 🐛 Remove duplicate values and add missing SAs

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

* chore: 🔖 Bump patch version

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>

---------

Signed-off-by: Javier Salmeron Garcia <jsalmeron@vmware.com>
This commit is contained in:
Javier J. Salmerón-García
2024-01-22 15:19:24 +01:00
committed by GitHub
parent cfbc329372
commit 3907f6c2c6
8 changed files with 80 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bitnami/jupyterhub/Chart.yaml
+1 -1
View File
@@ -37,4 +37,4 @@ maintainers:
name: jupyterhub
sources:
- https://github.com/bitnami/charts/tree/main/bitnami/jupyterhub
version: 5.5.0
version: 5.6.0
bitnami/jupyterhub/README.md
+15 -8
View File
@@ -141,6 +141,7 @@ The command removes all the Kubernetes components associated with the chart and
| `hub.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
| `hub.podSecurityContext.fsGroup` | Set Hub pod's Security Context fsGroup | `1001` |
| `hub.lifecycleHooks` | LifecycleHooks for the Hub container to automate configuration before or after startup | `{}` |
| `hub.automountServiceAccountToken` | Mount Service Account token in pod | `true` |
| `hub.hostAliases` | Add deployment host aliases | `[]` |
| `hub.podLabels` | Add extra labels to the Hub pods | `{}` |
| `hub.podAnnotations` | Add extra annotations to the Hub pods | `{}` |
@@ -168,14 +169,14 @@ The command removes all the Kubernetes components associated with the chart and
### Hub RBAC parameters
| Name | Description | Value |
| ------------------------------------------------- | ---------------------------------------------------------------------- | ------ |
| `hub.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `hub.serviceAccount.name` | Override Hub service account name | `""` |
| `hub.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `true` |
| `hub.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
| `hub.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `hub.rbac.rules` | Custom RBAC rules to set | `[]` |
| Name | Description | Value |
| ------------------------------------------------- | ---------------------------------------------------------------------- | ------- |
| `hub.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `hub.serviceAccount.name` | Override Hub service account name | `""` |
| `hub.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` |
| `hub.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
| `hub.rbac.create` | Specifies whether RBAC resources should be created | `true` |
| `hub.rbac.rules` | Custom RBAC rules to set | `[]` |
### Hub Traffic Exposure Parameters
@@ -271,6 +272,7 @@ The command removes all the Kubernetes components associated with the chart and
| `proxy.podSecurityContext.supplementalGroups` | Set filesystem extra groups | `[]` |
| `proxy.podSecurityContext.fsGroup` | Set Proxy pod's Security Context fsGroup | `1001` |
| `proxy.lifecycleHooks` | Add lifecycle hooks to the Proxy deployment | `{}` |
| `proxy.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `proxy.hostAliases` | Add deployment host aliases | `[]` |
| `proxy.podLabels` | Add extra labels to the Proxy pods | `{}` |
| `proxy.podAnnotations` | Add extra annotations to the Proxy pods | `{}` |
@@ -428,6 +430,10 @@ The command removes all the Kubernetes components associated with the chart and
| `imagePuller.extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for ImagePuller container(s) | `[]` |
| `imagePuller.initContainers` | Add additional init containers to the ImagePuller pods | `[]` |
| `imagePuller.sidecars` | Add additional sidecar containers to the ImagePuller pod | `[]` |
| `imagePuller.serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` |
| `imagePuller.serviceAccount.name` | Override image puller service account name | `""` |
| `imagePuller.serviceAccount.automountServiceAccountToken` | Allows auto mount of ServiceAccountToken on the serviceAccount created | `false` |
| `imagePuller.serviceAccount.annotations` | Additional custom annotations for the ServiceAccount | `{}` |
### Singleuser deployment parameters
@@ -440,6 +446,7 @@ The command removes all the Kubernetes components associated with the chart and
| `singleuser.image.pullSecrets` | Single User image pull secrets | `[]` |
| `singleuser.notebookDir` | Notebook directory (it will be the same as the PVC volume mount) | `/opt/bitnami/jupyterhub-singleuser` |
| `singleuser.allowPrivilegeEscalation` | Controls whether a process can gain more privileges than its parent process | `false` |
| `singleuser.automountServiceAccountToken` | Mount Service Account token in pod | `false` |
| `singleuser.command` | Override Single User default command | `[]` |
| `singleuser.extraEnvVars` | Extra environment variables that should be set for the user pods | `[]` |
| `singleuser.containerPort` | Single User container port | `8888` |
bitnami/jupyterhub/templates/_helpers.tpl
+11
View File
@@ -172,6 +172,17 @@ Return the proper Docker Image Registry Secret Names list
{{- include "jupyterhub.imagePullSecretsList" (dict "images" (list .Values.hub.image .Values.proxy.image .Values.auxiliaryImage) "global" .Values.global) -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
{{- define "jupyterhub.imagePullerServiceAccountName" -}}
{{- if .Values.hub.serviceAccount.create -}}
{{ default (printf "%s-image-puller" (include "common.names.fullname" .)) .Values.imagePuller.serviceAccount.name }}
{{- else -}}
{{ default "default" .Values.imagePuller.serviceAccount.name }}
{{- end -}}
{{- end -}}
{{/*
Create the name of the service account to use
*/}}
bitnami/jupyterhub/templates/hub/configmap.yaml
+1
View File
@@ -166,6 +166,7 @@ data:
("uid", None),
("fs_gid", None),
("service_account", "serviceAccountName"),
("automount_service_account_token", None),
("storage_extra_labels", "storage.extraLabels"),
# ("tolerations", "extraTolerations"), # Managed manually below
("node_selector", None),
bitnami/jupyterhub/templates/hub/deployment.yaml
+1
View File
@@ -41,6 +41,7 @@ spec:
spec:
serviceAccountName: {{ template "jupyterhub.hubServiceAccountName" . }}
{{- include "jupyterhub.imagePullSecrets" . | nindent 6 }}
automountServiceAccountToken: {{ .Values.hub.automountServiceAccountToken }}
{{- if .Values.hub.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hub.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/jupyterhub/templates/image-puller/daemonset.yaml
+2
View File
@@ -31,6 +31,8 @@ spec:
app.kubernetes.io/component: image-puller
spec:
{{- include "jupyterhub.imagePullSecrets" . | nindent 6 }}
serviceAccountName: {{ template "jupyterhub.imagePullerServiceAccountName" . }}
automountServiceAccountToken: {{ .Values.imagePuller.automountServiceAccountToken }}
{{- if .Values.imagePuller.hostAliases }}
hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.imagePuller.hostAliases "context" $) | nindent 8 }}
{{- end }}
bitnami/jupyterhub/templates/image-puller/service-account.yaml
+21
View File
@@ -0,0 +1,21 @@
{{- /*
Copyright VMware, Inc.
SPDX-License-Identifier: APACHE-2.0
*/}}
{{- if .Values.imagePuller.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ template "jupyterhub.imagePullerServiceAccountName" . }}
namespace: {{ .Release.Namespace | quote }}
{{- $versionLabel := dict "app.kubernetes.io/version" ( include "common.images.version" ( dict "imageRoot" .Values.hub.image "chart" .Chart ) ) }}
{{- $labels := include "common.tplvalues.merge" ( dict "values" ( list .Values.commonLabels $versionLabel ) "context" . ) }}
labels: {{- include "common.labels.standard" ( dict "customLabels" $labels "context" $ ) | nindent 4 }}
app.kubernetes.io/component: image-puller
{{- if or .Values.imagePuller.serviceAccount.annotations .Values.commonAnnotations }}
{{- $annotations := include "common.tplvalues.merge" ( dict "values" ( list .Values.imagePuller.serviceAccount.annotations .Values.commonAnnotations ) "context" . ) }}
annotations: {{- include "common.tplvalues.render" ( dict "value" $annotations "context" $) | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.imagePuller.serviceAccount.automountServiceAccountToken }}
{{- end }}
bitnami/jupyterhub/values.yaml
+28 -1
View File
@@ -199,6 +199,7 @@ hub:
containerSecurityContext: {{- omit .Values.singleuser.containerSecurityContext "enabled" | toYaml | nindent 4 }}
podSecurityContext: {{- omit .Values.singleuser.podSecurityContext "enabled" | toYaml | nindent 4 }}
serviceAccountName: {{ template "jupyterhub.singleuserServiceAccountName" . }}
automountServiceAccountToken: {{ .Values.singleuser.automountServiceAccountToken }}
storage:
{{- if .Values.singleuser.persistence.enabled }}
type: dynamic
@@ -383,6 +384,9 @@ hub:
## @param hub.lifecycleHooks LifecycleHooks for the Hub container to automate configuration before or after startup
##
lifecycleHooks: {}
## @param hub.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: true
## @param hub.hostAliases Add deployment host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
##
@@ -513,7 +517,7 @@ hub:
## @param hub.serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created
## Can be set to false if pods using this serviceAccount do not need to use K8s API
##
automountServiceAccountToken: true
automountServiceAccountToken: false
## @param hub.serviceAccount.annotations Additional custom annotations for the ServiceAccount
##
annotations: {}
@@ -822,6 +826,9 @@ proxy:
lifecycleHooks: {}
## Deployment pod host aliases
## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/
## @param proxy.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param proxy.hostAliases Add deployment host aliases
##
hostAliases: []
@@ -1468,6 +1475,23 @@ imagePuller:
## containerPort: 1234
##
sidecars: []
## ServiceAccount parameters
##
serviceAccount:
## @param imagePuller.serviceAccount.create Specifies whether a ServiceAccount should be created
##
create: true
## @param imagePuller.serviceAccount.name Override image puller service account name
## If not set and create is true, a name is generated using the fullname template
##
name: ""
## @param imagePuller.serviceAccount.automountServiceAccountToken Allows auto mount of ServiceAccountToken on the serviceAccount created
## Can be set to false if pods using this serviceAccount do not need to use K8s API
##
automountServiceAccountToken: false
## @param imagePuller.serviceAccount.annotations Additional custom annotations for the ServiceAccount
##
annotations: {}
## @section Singleuser deployment parameters
##
@@ -1509,6 +1533,9 @@ singleuser:
##
allowPrivilegeEscalation: false
## Command for running the container (set to default if not set). Use array form
## @param singleuser.automountServiceAccountToken Mount Service Account token in pod
##
automountServiceAccountToken: false
## @param singleuser.command Override Single User default command
##
command: []