pod SA, disable automount SA tokens

charts/drupal/templates/_helpers.tpl

@@ -732,3 +732,11 @@ autoscaling/v2beta1
 {{- else }}false
 {{- end }}
 {{- end }}
+
+{{- define "drupal.serviceAccountName" }}
+{{- if .Values.serviceAccount.name }}
+{{- .Values.serviceAccount.name }}
+{{- else }}
+{{- .Release.Name }}-sa
+{{- end }}
+{{- end }}

charts/drupal/templates/backup-cron.yaml

@@ -76,7 +76,7 @@ spec:
                 {{- else }}
                 claimName: {{ .Release.Name }}-backup
                 {{- end }}
-          {{- include "drupal.imagePullSecrets" . | nindent 10 }}
+          serviceAccountName: {{ include "drupal.serviceAccountName" . }}
 {{- end }}
 
 ---

charts/drupal/templates/clamav-deployment.yaml

@@ -68,4 +68,5 @@ spec:
       - name: avdata
         source:
           emptyDir: {}
+      serviceAccountName: {{ include "drupal.serviceAccountName" . }}
 {{- end }}

charts/drupal/templates/drupal-cron.yaml

@@ -159,7 +159,7 @@ spec:
           volumes:
             {{- include "drupal.volumes" $ | nindent 12 }}
 
-          {{- include "drupal.imagePullSecrets" $ | nindent 10 }}
+          serviceAccountName: {{ include "drupal.serviceAccountName" $ }}
 ---
 {{- end }}
 {{- end }}

charts/drupal/templates/drupal-deployment.yaml

@@ -166,7 +166,7 @@ spec:
         - name: sigsci-tmp
           emptyDir: {}
         {{- end }}
-      {{- include "drupal.imagePullSecrets" . | nindent 6 }}
+      serviceAccountName: {{ include "drupal.serviceAccountName" . }}
       nodeSelector:
         {{- .Values.php.nodeSelector | toYaml | nindent 8 }}
       tolerations:

charts/drupal/templates/post-release.yaml

@@ -40,7 +40,7 @@ spec:
           {{- end }}
         resources:
           {{- .Values.php.postinstall.resources | toYaml | nindent 10 }}
-      {{- include "drupal.imagePullSecrets" . | nindent 6 }}
+      serviceAccountName: {{ include "drupal.serviceAccountName" . }}
       volumes:
         {{- include "drupal.volumes" . | nindent 8 }}
         {{- if .Values.referenceData.enabled -}}

charts/drupal/templates/reference-data-cron.yaml

@@ -53,7 +53,7 @@ spec:
                 {{- else }}
                 claimName: {{ include "drupal.referenceEnvironment" . }}-reference-data
                 {{- end }}
-          {{- include "drupal.imagePullSecrets" . | nindent 10 }}
+          serviceAccountName: {{ include "drupal.serviceAccountName" . }}
 {{- end }}
 {{- end }}
 ---

charts/drupal/templates/serviceaccount.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-sa
+  labels:
+    {{- include "drupal.release_labels" . | nindent 4 }}
+automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+{{- include "drupal.imagePullSecrets" . }}
+

charts/drupal/templates/shell-deployment.yaml

@@ -100,6 +100,6 @@ spec:
           claimName: {{ .Release.Name }}-backup
           {{- end }}
       {{- end }}
-      {{- include "drupal.imagePullSecrets" . | nindent 6 }}
+      serviceAccountName: {{ include "drupal.serviceAccountName" . }}
 {{- end }}
 ---

charts/drupal/templates/silta-hub.yaml

@@ -35,7 +35,7 @@ data:
               {{- include "drupal.volumeMounts" . | nindent 14 }}
             resources:
               {{- .Values.php.postinstall.resources | toYaml | nindent 14 }}
-          {{- include "drupal.imagePullSecrets" . | nindent 10 }}
+          serviceAccountName: {{ include "drupal.serviceAccountName" . }}
           volumes:
             {{- include "drupal.volumes" . | nindent 12 }}
   syncPullJob: |
@@ -63,6 +63,6 @@ data:
               {{- include "drupal.volumeMounts" . | nindent 14 }}
             resources:
               {{- .Values.php.postinstall.resources | toYaml | nindent 14 }}
-          {{- include "drupal.imagePullSecrets" . | nindent 10 }}
+          serviceAccountName: {{ .Release.Name }}-sa
           volumes:
             {{- include "drupal.volumes" . | nindent 12 }}

charts/drupal/templates/solr-statefulset.yaml

@@ -79,7 +79,7 @@ spec:
       volumes:
       - name: {{ .Release.Name }}-core-dir
         emptyDir: {}
-
+      serviceAccountName: {{ include "drupal.serviceAccountName" . }}
   volumeClaimTemplates:
   - metadata:
       name: {{ .Release.Name }}-solr-data

charts/drupal/templates/varnish-deployment.yaml

@@ -74,4 +74,5 @@ spec:
       - name: varnish-secret
         secret:
           secretName: {{ .Release.Name }}-secrets-varnish
+      serviceAccountName: {{ include "drupal.serviceAccountName" . }}
 {{- end }}

charts/drupal/tests/private_docker_image_test.yaml

@@ -1,47 +1,21 @@
 suite: private docker image
 templates:
-  - drupal-configmap.yaml
-  - drupal-cron.yaml
-  - drupal-deployment.yaml
-  - drupal-secret.yaml
-  - post-release.yaml
-capabilities:
-  apiVersions:
-    - pxc.percona.com/v1
+  - serviceaccount.yaml
+
 tests:
   - it: has no image pull secret by default
-    template: drupal-deployment.yaml
+    template: serviceaccount.yaml
     asserts:
       - isNull:
           path: spec.template.spec.imagePullSecrets
-      - template: drupal-cron.yaml
-        isNull:
-          path: spec.jobTemplate.spec.template.spec.imagePullSecrets
-      - template: post-release.yaml
-        isNull:
-          path: spec.template.spec.imagePullSecrets
 
   - it: sets the image pull secret
-    template: drupal-deployment.yaml
+    template: serviceaccount.yaml
     set:
       imagePullSecrets:
         - name: gcr
     asserts:
      - contains:
-         path: spec.template.spec.imagePullSecrets
-         content:
-           name: gcr
-
-     - template: drupal-cron.yaml
-       contains:
-         path: spec.jobTemplate.spec.template.spec.imagePullSecrets
+         path: imagePullSecrets
          content:
            name: gcr
-
-     - template: post-release.yaml
-       contains:
-         path: spec.template.spec.imagePullSecrets
-         content:
-           name: gcr
-
-

charts/drupal/tests/serviceaccount_test.yaml

@@ -0,0 +1,56 @@
+suite: service account test
+templates:
+  - drupal-configmap.yaml
+  - drupal-cron.yaml
+  - drupal-deployment.yaml
+  - drupal-secret.yaml
+  - post-release.yaml
+  - backup-cron.yaml
+tests:
+  - it: has default release serviceaccount by default
+    template: drupal-deployment.yaml
+    set:
+      backup:
+        enabled: true
+    asserts:
+      - template: drupal-deployment.yaml
+        equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-sa
+      - template: drupal-cron.yaml
+        equal:
+          path: spec.jobTemplate.spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-sa
+      - template: post-release.yaml
+        equal:
+          path: spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-sa
+      - template: backup-cron.yaml
+        equal:
+          path: spec.jobTemplate.spec.template.spec.serviceAccountName
+          value: RELEASE-NAME-sa
+
+  - it: can set a custom serviceaccount
+    template: drupal-deployment.yaml
+    set:
+      serviceAccount:
+        name: foo
+      backup:
+        enabled: true
+    asserts:
+      - template: drupal-deployment.yaml
+        equal:
+          path: spec.template.spec.serviceAccountName
+          value: foo
+      - template: drupal-cron.yaml
+        equal:
+          path: spec.jobTemplate.spec.template.spec.serviceAccountName
+          value: foo
+      - template: post-release.yaml
+        equal:
+          path: spec.template.spec.serviceAccountName
+          value: foo
+      - template: backup-cron.yaml
+        equal:
+          path: spec.jobTemplate.spec.template.spec.serviceAccountName
+          value: foo

charts/drupal/values.schema.json

@@ -8,6 +8,14 @@
     "branchName": { "type": "string" },
     "imagePullSecrets": { "type": "array" },
     "imagePullSecret": { "type": "string" },
+    "serviceAccount": { 
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "automountServiceAccountToken": { "type": "boolean" }
+      }
+    },
     "app": { "type": "string" },
     "webRoot": { "type": "string" },
 

charts/drupal/values.yaml

@@ -27,6 +27,12 @@ imagePullSecrets: []
 # Custom imagePullSecret for the containers. Base64 encoded. This will create a secret and append it to the imagePullSecrets.
 imagePullSecret: ""
 
+serviceAccount:
+  # Default value: [Release.Name]-sa
+  name: ""
+  # Mount service account token to the containers.
+  automountServiceAccountToken: false
+
 # The app label added to our Kubernetes resources.
 app: drupal
 
@@ -593,6 +599,8 @@ mariadb:
               operator: NotIn
               values:
               - static-ip
+  serviceAccount:
+    create: true
   enableServiceLinks: false
 
 varnish:
@@ -657,6 +665,10 @@ elasticsearch:
   # Disable service links that cause a slow startup.
   enableServiceLinks: false
 
+  rbac:
+    create: true
+    automountToken: false
+
   # This value should be slightly less than 50% of the requested memory.
   esJavaOpts: -Xmx220m -Xms220m
   xpack:
@@ -687,6 +699,9 @@ elasticsearch:
 memcached:
   enabled: false
   replicaCount: 1
+  serviceAccount:
+    create: true
+  automountServiceAccountToken: false
   resources:
     requests:
       cpu: 10m
@@ -700,7 +715,7 @@ memcached:
     # MaxItemSize
     - -I 4M
 
-# https://github.com/bitnami/charts/blob/master/bitnami/redis/values.yaml
+# https://github.com/bitnami/charts/blob/d4dba2b393167d79b8c8f65b46c48b70ee3a9662/bitnami/redis/values.yaml
 redis:
   enabled: false
   architecture: standalone
@@ -719,6 +734,8 @@ redis:
       requests:
         cpu: 50m
         memory: 256Mi
+  serviceAccount:
+    automountServiceAccountToken: false
 
 # Mailhog service overrides
 # see: https://github.com/codecentric/helm-charts/blob/master/charts/mailhog/values.yaml