Merge pull request #97 from codefresh-io/feat/acr-controller

feat: support acr controller as part of argocd deployment

charts/argo-cd/Chart.yaml

@@ -1,5 +1,5 @@
 apiVersion: v2
-appVersion: v2.12-2024.9.9-ba613c5bd
+appVersion: v2.12-2024.9.23-0dc32342c
 kubeVersion: ">=1.23.0-0"
 description: A Helm chart for Argo CD, a declarative, GitOps continuous delivery tool for Kubernetes.
 name: argo-cd
@@ -27,4 +27,4 @@ annotations:
     url: https://argoproj.github.io/argo-helm/pgp_keys.asc
   artifacthub.io/changes: |
     - kind: changed
-      description: Upgrade argo-cd to v2.12-2024.9.9-ba613c5bd with reporting of resources health errors on level with application event
+      description: Upgrade argo-cd to v2.12-2024.9.23-0dc32342c with and add acr controller support

charts/argo-cd/README.md

@@ -669,6 +669,47 @@ NAME: my-release
 
 | Key | Type | Default | Description |
 |-----|------|---------|-------------|
+| acrController.affinity | object | `{}` (defaults to global.affinity preset) | Assign custom [affinity] rules to the deployment |
+| acrController.clusterRoleRules.enabled | bool | `false` | Enable custom rules for the acr controller's ClusterRole resource |
+| acrController.clusterRoleRules.rules | list | `[]` | List of custom rules for the acr controller's ClusterRole resource |
+| acrController.containerPorts.health | int | `8090` |  |
+| acrController.containerSecurityContext | object | See [values.yaml] | acr controller container-level security context |
+| acrController.dnsConfig | object | `{}` | [DNS configuration] |
+| acrController.dnsPolicy | string | `"ClusterFirst"` | Alternative DNS policy for acr controller pods |
+| acrController.enabled | bool | `false` |  |
+| acrController.env | list | `[]` | Environment variables to pass to acr controller |
+| acrController.envFrom | list | `[]` (See [values.yaml]) | envFrom to pass to acr controller |
+| acrController.extraArgs | list | `[]` | Additional command line arguments to pass to acr controller |
+| acrController.extraContainers | list | `[]` | Additional containers to be added to the acr controller pod |
+| acrController.hostNetwork | bool | `false` | Host Network for acr controller pods |
+| acrController.image.imagePullPolicy | string | `""` (defaults to global.image.imagePullPolicy) | Image pull policy for the acr controller |
+| acrController.image.repository | string | `""` (defaults to global.image.repository) | Repository to use for the acr controller |
+| acrController.image.tag | string | `""` (defaults to global.image.tag) | Tag to use for the acr controller |
+| acrController.imagePullSecrets | list | `[]` (defaults to global.imagePullSecrets) | Secrets with credentials to pull images from a private registry |
+| acrController.initContainers | list | `[]` | Init containers to add to the acr controller pod |
+| acrController.name | string | `"acr-controller"` |  |
+| acrController.nodeSelector | object | `{}` (defaults to global.nodeSelector) | [Node selector] |
+| acrController.podAnnotations | object | `{}` | Annotations to be added to acr controller pods |
+| acrController.podLabels | object | `{}` | Labels to be added to acr controller pods |
+| acrController.priorityClassName | string | `""` (defaults to global.priorityClassName) | Priority class for the acr controller pods |
+| acrController.readinessProbe.failureThreshold | int | `3` | Minimum consecutive failures for the [probe] to be considered failed after having succeeded |
+| acrController.readinessProbe.initialDelaySeconds | int | `10` | Number of seconds after the container has started before [probe] is initiated |
+| acrController.readinessProbe.periodSeconds | int | `10` | How often (in seconds) to perform the [probe] |
+| acrController.readinessProbe.successThreshold | int | `1` | Minimum consecutive successes for the [probe] to be considered successful after having failed |
+| acrController.readinessProbe.timeoutSeconds | int | `1` | Number of seconds after which the [probe] times out |
+| acrController.replicas | int | `1` |  |
+| acrController.resources | object | `{}` | Resource limits and requests for the acr controller pods |
+| acrController.serviceAccount.annotations | object | `{}` | Annotations applied to created service account |
+| acrController.serviceAccount.automountServiceAccountToken | bool | `true` | Automount API credentials for the Service Account |
+| acrController.serviceAccount.create | bool | `true` | Create a service account for the acr controller |
+| acrController.serviceAccount.labels | object | `{}` | Labels applied to created service account |
+| acrController.serviceAccount.name | string | `"acr-controller"` | Service account name |
+| acrController.statefulsetAnnotations | object | `{}` | Annotations for the acr controller StatefulSet |
+| acrController.terminationGracePeriodSeconds | int | `30` | terminationGracePeriodSeconds for container lifecycle hook |
+| acrController.tolerations | list | `[]` (defaults to global.tolerations) | [Tolerations] for use with node taints |
+| acrController.topologySpreadConstraints | list | `[]` (defaults to global.topologySpreadConstraints) | Assign custom [TopologySpreadConstraints] rules to the acr controller |
+| acrController.volumeMounts | list | `[]` | Additional volumeMounts to the acr controller main container |
+| acrController.volumes | list | `[]` | Additional volumes to the acr controller pod |
 | apiVersionOverrides | object | `{}` |  |
 | applicationVersioning.enabled | bool | `true` | enables the Codefresh application versioning feature |
 | applicationVersioning.useApplicationConfiguration | bool | `true` | use ApplicationConfiguration CRD to manage application versioning |

charts/argo-cd/templates/_helpers.tpl

@@ -285,3 +285,20 @@ Helper template to set argocd server url in event reporter
   {{- end }}
   {{- printf "%s:%v" (include "argo-cd.server.fullname" .) $port }}
 {{- end -}}
+
+{{/*
+  Create acr controller name and version as used by the chart label.
+*/}}
+{{- define "argo-cd.acr-controller.fullname" -}}
+{{- printf "%s-%s" (include "argo-cd.fullname" .) .Values.acrController.name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{/*
+  Create the name of the acr controller service account to use
+  */}}
+{{- define "argo-cd.acrControllerServiceAccountName" -}}
+{{- if .Values.acrController.serviceAccount.create -}}
+{{ default (include "argo-cd.acr-controller.fullname" .) .Values.acrController.serviceAccount.name }}
+{{- else -}}
+{{ default "default" .Values.acrController.serviceAccount.name }}
+{{- end -}}
+{{- end -}}

charts/argo-cd/templates/acr-controller/clusterrole.yaml

@@ -0,0 +1,26 @@
+{{- if .Values.acrController.enabled }}
+{{- $config := .Values.acrController.clusterAdminAccess | default dict -}}
+{{- if hasKey $config "enabled" | ternary $config.enabled .Values.createClusterRoles }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "argo-cd.acr-controller.fullname" . }}
+  labels:
+    {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 4 }}
+rules:
+  {{- if .Values.acrController.clusterRoleRules.enabled }}
+    {{- toYaml .Values.acrController.clusterRoleRules.rules | nindent 2 }}
+  {{- else }}
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - applications
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+      - update
+{{- end }}
+{{- end }}
+{{- end }}

charts/argo-cd/templates/acr-controller/clusterrolebinding.yaml

@@ -0,0 +1,19 @@
+{{- if .Values.acrController.enabled }}
+{{- $config := .Values.acrController.clusterAdminAccess | default dict -}}
+{{- if hasKey $config "enabled" | ternary $config.enabled .Values.createClusterRoles }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "argo-cd.acr-controller.fullname" . }}
+  labels:
+    {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ include "argo-cd.acr-controller.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "argo-cd.acrControllerServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}
+{{- end }}

charts/argo-cd/templates/acr-controller/deployment.yaml

@@ -0,0 +1,161 @@
+{{- if .Values.acrController.enabled }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  {{- with (mergeOverwrite (deepCopy .Values.global.statefulsetAnnotations) .Values.acrController.statefulsetAnnotations) }}
+  annotations:
+    {{- range $key, $value := . }}
+    {{ $key }}: {{ $value | quote }}
+    {{- end }}
+  {{- end }}
+  name: {{ template "argo-cd.acr-controller.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 4 }}
+spec:
+  replicas: {{ .Values.acrController.replicas }}
+  # TODO: Remove for breaking release as history limit cannot be patched
+  revisionHistoryLimit: 5
+  selector:
+    matchLabels:
+      {{- include "argo-cd.selectorLabels" (dict "context" . "name" .Values.acrController.name) | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 8 }}
+        {{- with (mergeOverwrite (deepCopy .Values.global.podLabels) .Values.acrController.podLabels) }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+    spec:
+      {{- with .Values.acrController.imagePullSecrets | default .Values.global.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.global.hostAliases }}
+      hostAliases:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.global.securityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.acrController.priorityClassName | default .Values.global.priorityClassName }}
+      priorityClassName: {{ . }}
+      {{- end }}
+      {{- if .Values.acrController.terminationGracePeriodSeconds }}
+      terminationGracePeriodSeconds: {{ .Values.acrController.terminationGracePeriodSeconds }}
+      {{- end }}
+      serviceAccountName: {{ include "argo-cd.acrControllerServiceAccountName" . }}
+      containers:
+      - args:
+        - /usr/local/bin/argocd-application-change-revision-controller
+        {{- with .Values.acrController.extraArgs }}
+          {{- toYaml . | nindent 8 }}
+        {{- end }}
+        image: {{ default .Values.global.image.repository .Values.acrController.image.repository }}:{{ default (include "argo-cd.defaultTag" .) .Values.acrController.image.tag }}
+        imagePullPolicy: {{ default .Values.global.image.imagePullPolicy .Values.acrController.image.imagePullPolicy }}
+        name: {{ .Values.acrController.name }}
+        env:
+          {{- with (concat .Values.global.env .Values.acrController.env) }}
+            {{- toYaml . | nindent 10 }}
+          {{- end }}
+            - name: ARGOCD_SERVER
+              value: "http://argocd-server:80"
+            - name: ARGOCD_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  key: token
+                  name: argocd-token
+            - name: ARGOCD_APPLICATION_NAMESPACES
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: application.namespaces
+                  optional: true
+            - name: ACR_CONTROLLER_LOGFORMAT
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: acr.log.format
+                  optional: true
+            - name: ACR_CONTROLLER_LOG_LEVEL
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: acr.log.level
+                  optional: true
+            - name: ACR_CONTROLLER_LISTEN_ADDRESS
+              valueFrom:
+                configMapKeyRef:
+                  name: argocd-cmd-params-cm
+                  key: acr.listen.address
+                  optional: true
+        {{- with .Values.acrController.envFrom }}
+        envFrom:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+        ports:
+          - name: health
+            containerPort: {{ .Values.acrController.containerPorts.health }}
+            protocol: TCP
+        livenessProbe:
+          httpGet:
+            path: /healthz?full=true
+            port: health
+          initialDelaySeconds: 3
+          periodSeconds: 30
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: health
+          initialDelaySeconds: {{ .Values.acrController.readinessProbe.initialDelaySeconds }}
+          periodSeconds: {{ .Values.acrController.readinessProbe.periodSeconds }}
+          timeoutSeconds: {{ .Values.acrController.readinessProbe.timeoutSeconds }}
+          successThreshold: {{ .Values.acrController.readinessProbe.successThreshold }}
+          failureThreshold: {{ .Values.acrController.readinessProbe.failureThreshold }}
+        resources:
+          {{- toYaml .Values.acrController.resources | nindent 12 }}
+        {{- with .Values.acrController.containerSecurityContext }}
+        securityContext:
+          {{- toYaml . | nindent 10 }}
+        {{- end }}
+      {{- with .Values.acrController.extraContainers }}
+        {{- tpl (toYaml .) $ | nindent 6 }}
+      {{- end }}
+      {{- with .Values.acrController.initContainers }}
+      initContainers:
+        {{- tpl (toYaml .) $ | nindent 6 }}
+      {{- end }}
+      {{- with include "argo-cd.affinity" (dict "context" . "component" .Values.acrController) }}
+      affinity:
+        {{- trim . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.acrController.nodeSelector | default .Values.global.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.acrController.tolerations | default .Values.global.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.acrController.topologySpreadConstraints | default .Values.global.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- range $constraint := . }}
+      - {{ toYaml $constraint | nindent 8 | trim }}
+          {{- if not $constraint.labelSelector }}
+        labelSelector:
+          matchLabels:
+            {{- include "argo-cd.selectorLabels" (dict "context" $ "name" $.Values.acrController.name) | nindent 12 }}
+          {{- end }}
+        {{- end }}
+      {{- end }}
+      {{- if .Values.acrController.hostNetwork }}
+      hostNetwork: {{ .Values.acrController.hostNetwork }}
+      {{- end }}
+      {{- with .Values.acrController.dnsConfig }}
+      dnsConfig:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      dnsPolicy: {{ .Values.acrController.dnsPolicy }}
+{{- end }}

charts/argo-cd/templates/acr-controller/role.yaml

@@ -0,0 +1,20 @@
+{{- if .Values.acrController.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ template "argo-cd.acr-controller.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 4 }}
+rules:
+  - apiGroups:
+      - argoproj.io
+    resources:
+      - applications
+    verbs:
+      - get
+      - list
+      - watch
+      - patch
+      - update
+{{- end }}

charts/argo-cd/templates/acr-controller/rolebinding.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.acrController.enabled }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ template "argo-cd.acr-controller.fullname" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ template "argo-cd.acr-controller.fullname" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "argo-cd.acrControllerServiceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+{{- end }}

charts/argo-cd/templates/acr-controller/serviceaccount.yaml

@@ -0,0 +1,19 @@
+{{- if and .Values.acrController.enabled .Values.acrController.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.acrController.serviceAccount.automountServiceAccountToken }}
+metadata:
+  name: {{ template "argo-cd.acrControllerServiceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+{{- if .Values.acrController.serviceAccount.annotations }}
+  annotations:
+  {{- range $key, $value := .Values.acrController.serviceAccount.annotations }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+{{- end }}
+  labels:
+    {{- include "argo-cd.labels" (dict "context" . "component" .Values.acrController.name "name" .Values.acrController.name) | nindent 4 }}
+  {{- range $key, $value := .Values.acrController.serviceAccount.labels }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+{{- end }}

charts/argo-cd/templates/crds/crd-application.yaml

@@ -125,6 +125,12 @@ spec:
               sync:
                 description: Sync contains parameters for the operation
                 properties:
+                  changeRevision:
+                    type: string
+                  changeRevisions:
+                    items:
+                      type: string
+                    type: array
                   dryRun:
                     description: DryRun specifies to perform a `kubectl apply --dry-run`
                       without actually performing the sync
@@ -2547,6 +2553,12 @@ spec:
                       sync:
                         description: Sync contains parameters for the operation
                         properties:
+                          changeRevision:
+                            type: string
+                          changeRevisions:
+                            items:
+                              type: string
+                            type: array
                           dryRun:
                             description: DryRun specifies to perform a `kubectl apply
                               --dry-run` without actually performing the sync

charts/argo-cd/values.yaml

@@ -3948,3 +3948,174 @@ eventReporter:
     enabled: false
     # -- List of custom rules for the event reporter's ClusterRole resource
     rules: []
+
+acrController:
+  # Enabled we need to skip argo-cd chart tests for this component
+  enabled: false
+  name: acr-controller
+  ## Amount of replicas for event reporting sharding
+  replicas: 1
+  ## ACR controller image
+  image:
+    # -- Repository to use for the acr controller
+    # @default -- `""` (defaults to global.image.repository)
+    repository: ""
+    # -- Tag to use for the acr controller
+    # @default -- `""` (defaults to global.image.tag)
+    tag: ""
+    # -- Image pull policy for the acr controller
+    # @default -- `""` (defaults to global.image.imagePullPolicy)
+    imagePullPolicy: ""
+
+  # -- Secrets with credentials to pull images from a private registry
+  # @default -- `[]` (defaults to global.imagePullSecrets)
+  imagePullSecrets: []
+
+  # -- Additional command line arguments to pass to acr controller
+  extraArgs: []
+
+  # -- Environment variables to pass to acr controller
+  env: []
+
+  # -- envFrom to pass to acr controller
+  # @default -- `[]` (See [values.yaml])
+  envFrom: []
+  # - configMapRef:
+  #     name: config-map-name
+  # - secretRef:
+  #     name: secret-name
+
+  # -- Additional containers to be added to the acr controller pod
+  ## Note: Supports use of custom Helm templates
+  extraContainers: []
+
+  # -- Init containers to add to the acr controller pod
+  ## If your target Kubernetes cluster(s) require a custom credential (exec) plugin
+  ## you could use this (and the same in the server pod) to provide such executable
+  ## Ref: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins
+  ## Note: Supports use of custom Helm templates
+  initContainers: []
+  #  - name: download-tools
+  #    image: alpine:3
+  #    command: [sh, -c]
+  #    args:
+  #      - wget -qO kubelogin.zip https://github.com/Azure/kubelogin/releases/download/v0.0.25/kubelogin-linux-amd64.zip &&
+  #        unzip kubelogin.zip && mv bin/linux_amd64/kubelogin /custom-tools/
+  #    volumeMounts:
+  #      - mountPath: /custom-tools
+  #        name: custom-tools
+
+  # -- Additional volumeMounts to the acr controller main container
+  volumeMounts: []
+  #  - mountPath: /usr/local/bin/kubelogin
+  #    name: custom-tools
+  #    subPath: kubelogin
+
+  # -- Additional volumes to the acr controller pod
+  volumes: []
+  #  - name: custom-tools
+  #    emptyDir: {}
+
+  # -- Annotations for the acr controller StatefulSet
+  statefulsetAnnotations: {}
+
+  # -- Annotations to be added to acr controller pods
+  podAnnotations: {}
+
+  # -- Labels to be added to acr controller pods
+  podLabels: {}
+
+  # -- Resource limits and requests for the acr controller pods
+  resources: {}
+  #  limits:
+  #    cpu: 500m
+  #    memory: 512Mi
+  #  requests:
+  #    cpu: 250m
+  #    memory: 256Mi
+
+  # ACR controller container ports
+  containerPorts:
+    health: 8090
+
+  # -- Host Network for acr controller pods
+  hostNetwork: false
+
+  # -- [DNS configuration]
+  dnsConfig: {}
+  # -- Alternative DNS policy for acr controller pods
+  dnsPolicy: "ClusterFirst"
+
+  # -- acr controller container-level security context
+  # @default -- See [values.yaml]
+  containerSecurityContext:
+    runAsNonRoot: true
+    readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    seccompProfile:
+      type: RuntimeDefault
+    capabilities:
+      drop:
+        - ALL
+
+  # Readiness probe for acr controller
+  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/
+  readinessProbe:
+    # -- Minimum consecutive failures for the [probe] to be considered failed after having succeeded
+    failureThreshold: 3
+    # -- Number of seconds after the container has started before [probe] is initiated
+    initialDelaySeconds: 10
+    # -- How often (in seconds) to perform the [probe]
+    periodSeconds: 10
+    # -- Minimum consecutive successes for the [probe] to be considered successful after having failed
+    successThreshold: 1
+    # -- Number of seconds after which the [probe] times out
+    timeoutSeconds: 1
+
+  # -- terminationGracePeriodSeconds for container lifecycle hook
+  terminationGracePeriodSeconds: 30
+
+  # -- Priority class for the acr controller pods
+  # @default -- `""` (defaults to global.priorityClassName)
+  priorityClassName: ""
+
+  # -- [Node selector]
+  # @default -- `{}` (defaults to global.nodeSelector)
+  nodeSelector: {}
+
+  # -- [Tolerations] for use with node taints
+  # @default -- `[]` (defaults to global.tolerations)
+  tolerations: []
+
+  # -- Assign custom [affinity] rules to the deployment
+  # @default -- `{}` (defaults to global.affinity preset)
+  affinity: {}
+
+  # -- Assign custom [TopologySpreadConstraints] rules to the acr controller
+  # @default -- `[]` (defaults to global.topologySpreadConstraints)
+  ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+  ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
+  topologySpreadConstraints: []
+  # - maxSkew: 1
+  #   topologyKey: topology.kubernetes.io/zone
+  #   whenUnsatisfiable: DoNotSchedule
+
+  serviceAccount:
+    # -- Create a service account for the acr controller
+    create: true
+    # -- Service account name
+    name: acr-controller
+    # -- Annotations applied to created service account
+    annotations: {}
+    # -- Labels applied to created service account
+    labels: {}
+    # -- Automount API credentials for the Service Account
+    automountServiceAccountToken: true
+
+  ## Enable this and set the rules: to whatever custom rules you want for the Cluster Role resource.
+  ## Defaults to off
+  clusterRoleRules:
+    # -- Enable custom rules for the acr controller's ClusterRole resource
+    enabled: false
+    # -- List of custom rules for the acr controller's ClusterRole resource
+    rules: []