Skip to content

feat(chart): expose automountServiceAccountToken and extra volumes #461

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tejassinghbhati wants to merge 1 commit into
base: main
Choose a base branch
from
+155 −0
Open

feat(chart): expose automountServiceAccountToken and extra volumes #461

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions charts/node-readiness-controller/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,6 +77,9 @@ The following table lists the configurable parameters of the _node-readiness-con
| `serviceAccount.create` | If `true`, create a service account | `true` |
| `serviceAccount.name` | The name of the service account to use, if not set and create is true a name is generated using the fullname template | `nil` |
| `serviceAccount.annotations` | Specifies custom annotations for the serviceAccount | `{}` |
| `serviceAccount.automountServiceAccountToken` | Whether the API server automounts a ServiceAccount token. Rendered on both the ServiceAccount and the pod spec so Gatekeeper and Pod Security policies see it set explicitly | `true` |
| `extraVolumes` | Additional volumes on the controller pod. Needed to supply a projected token when automounting is disabled | `[]` |
| `extraVolumeMounts` | Additional volume mounts on the controller container | `[]` |
| `podAnnotations` | Annotations to add to the node-readiness-controller Pods | `{"kubectl.kubernetes.io/default-container":"manager"}` |
| `podLabels` | Labels to add to the node-readiness-controller Pods | `{}` |
| `commonLabels` | Labels to apply to all resources | `{}` |
Expand Down
7 changes: 7 additions & 0 deletions charts/node-readiness-controller/templates/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ spec:
{{- end }}
spec:
serviceAccountName: {{ include "node-readiness-controller.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
Expand Down Expand Up @@ -109,6 +110,9 @@ spec:
mountPath: {{ .Values.metrics.certDir }}
readOnly: true
{{- end }}
{{- with .Values.extraVolumeMounts }}
{{- toYaml . | nindent 12 }}
{{- end }}
volumes:
{{- if .Values.webhook.enabled }}
- name: cert
Expand All @@ -121,6 +125,9 @@ spec:
secret:
secretName: {{ .Values.metrics.certSecretName }}
{{- end }}
{{- with .Values.extraVolumes }}
{{- toYaml . | nindent 8 }}
{{- end }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 8 }}
Expand Down
1 change: 1 addition & 0 deletions charts/node-readiness-controller/templates/serviceaccount.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,4 +10,5 @@ metadata:
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- end }}
106 changes: 106 additions & 0 deletions charts/node-readiness-controller/tests/automount_test.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,106 @@
suite: Test ServiceAccount token automounting and extra volumes

templates:
- "*.yaml"

release:
name: node-readiness-controller

tests:
- it: sets automountServiceAccountToken on the ServiceAccount by default
template: templates/serviceaccount.yaml
asserts:
- isKind:
of: ServiceAccount
- equal:
path: automountServiceAccountToken
value: true

- it: sets automountServiceAccountToken on the pod spec by default
template: templates/deployment.yaml
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: true

# Gatekeeper policies care that the field is explicitly false, not absent,
# so assert the rendered value rather than just its absence.
- it: renders false on both objects when automounting is disabled
set:
serviceAccount:
automountServiceAccountToken: false
asserts:
- equal:
path: automountServiceAccountToken
value: false
template: templates/serviceaccount.yaml
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false
template: templates/deployment.yaml

- it: adds extra volumes and mounts when supplied
template: templates/deployment.yaml
set:
extraVolumes:
- name: sa-token
projected:
sources:
- serviceAccountToken:
path: token
expirationSeconds: 3600
extraVolumeMounts:
- name: sa-token
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
readOnly: true
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: sa-token
projected:
sources:
- serviceAccountToken:
path: token
expirationSeconds: 3600
- contains:
path: spec.template.spec.containers[0].volumeMounts
content:
name: sa-token
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
readOnly: true

# The chart already mounts webhook and metrics certificates, so the extra
# entries have to be additive rather than replacing them.
- it: keeps the cert volumes alongside extra volumes
template: templates/deployment.yaml
set:
webhook:
enabled: true
extraVolumes:
- name: sa-token
emptyDir: {}
extraVolumeMounts:
- name: sa-token
mountPath: /var/run/secrets/kubernetes.io/serviceaccount
asserts:
- contains:
path: spec.template.spec.volumes
content:
name: cert
secret:
secretName: webhook-server-certs
defaultMode: 420
- contains:
path: spec.template.spec.volumes
content:
name: sa-token
emptyDir: {}

# volumes is rendered unconditionally by the template, so it is present but
# empty when nothing opts in.
- it: renders no extra volumes by default
template: templates/deployment.yaml
asserts:
- isNullOrEmpty:
path: spec.template.spec.volumes
38 changes: 38 additions & 0 deletions charts/node-readiness-controller/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -86,6 +86,12 @@ serviceAccount:
create: true
name: ""
annotations: {}
# -- Whether the API server should automount a ServiceAccount token. Rendered on
# the ServiceAccount and on the pod spec, since Gatekeeper and Pod Security
# policies commonly require it to be set explicitly rather than left to the
# cluster default. Set false and supply a projected token through extraVolumes
# if your policy forbids automounting.
automountServiceAccountToken: true

# Enable leader election to support multiple replicas
leaderElection:
Expand Down Expand Up @@ -163,6 +169,38 @@ validatingWebhook:

nodeSelector: {}

# -- Additional volumes on the controller pod.
# The controller authenticates with rest.InClusterConfig(), which needs a token,
# ca.crt and namespace under /var/run/secrets/kubernetes.io/serviceaccount. When
# serviceAccount.automountServiceAccountToken is false you have to provide all
# three yourself, for example:
#
# extraVolumes:
# - name: sa-token
# projected:
# sources:
# - serviceAccountToken:
# path: token
# expirationSeconds: 3600
# - configMap:
# name: kube-root-ca.crt
# items:
# - key: ca.crt
# path: ca.crt
# - downwardAPI:
# items:
# - path: namespace
# fieldRef:
# fieldPath: metadata.namespace
# extraVolumeMounts:
# - name: sa-token
# mountPath: /var/run/secrets/kubernetes.io/serviceaccount
# readOnly: true
extraVolumes: []

# -- Additional volume mounts on the controller container.
extraVolumeMounts: []

tolerations:
- effect: NoSchedule
operator: Exists
Expand Down