DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Chart: Set automountServiceAccountToken in workloads. (#12247)

Browse source 
Signed-off-by: Aran Shavit <Aranshavit@gmail.com>
Co-authored-by: Marco Ebert <marco_ebert@icloud.com>
This commit is contained in:
Aran Shavit 2024-10-29 22:55:25 +02:00 committed by GitHub
parent bd76cf8f05
commit e07f0f6890
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
10 changed files with 55 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml
View file

@ -67,6 +67,7 @@ spec:
{{- end }}
restartPolicy: OnFailure
serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }}
{{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
{{- end }}

1
charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml
View file

@ -69,6 +69,7 @@ spec:
{{- end }}
restartPolicy: OnFailure
serviceAccountName: {{ include "ingress-nginx.admissionWebhooks.patch.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken }}
{{- if .Values.controller.admissionWebhooks.patch.nodeSelector }}
nodeSelector: {{ toYaml .Values.controller.admissionWebhooks.patch.nodeSelector | nindent 8 }}
{{- end }}

1
charts/ingress-nginx/templates/controller-daemonset.yaml
View file

@ -202,6 +202,7 @@ spec:
topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }}
{{- end }}
serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }}
volumes:

1
charts/ingress-nginx/templates/controller-deployment.yaml
View file

@ -208,6 +208,7 @@ spec:
topologySpreadConstraints: {{ tpl (toYaml .Values.controller.topologySpreadConstraints) $ | nindent 8 }}
{{- end }}
serviceAccountName: {{ template "ingress-nginx.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
terminationGracePeriodSeconds: {{ .Values.controller.terminationGracePeriodSeconds }}
{{- if (or .Values.controller.customTemplate.configMapName .Values.controller.extraVolumeMounts .Values.controller.admissionWebhooks.enabled .Values.controller.extraVolumes .Values.controller.extraModules) }}
volumes:

1
charts/ingress-nginx/templates/default-backend-deployment.yaml
View file

@ -103,6 +103,7 @@ spec:
nodeSelector: {{ toYaml .Values.defaultBackend.nodeSelector | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "ingress-nginx.defaultBackend.serviceAccountName" . }}
automountServiceAccountToken: {{ .Values.defaultBackend.serviceAccount.automountServiceAccountToken }}
{{- if .Values.defaultBackend.tolerations }}
tolerations: {{ toYaml .Values.defaultBackend.tolerations | nindent 8 }}
{{- end }}

12
charts/ingress-nginx/tests/admission-webhooks/job-patch/job-createSecret_test.yaml Normal file
View file

@ -0,0 +1,12 @@
suite: Admission Webhooks > Patch Job > Create Secret Job
templates:
- admission-webhooks/job-patch/job-createSecret.yaml
tests:
- it: should create a Job with token auto-mounting disabled if `controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken` is false
set:
controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

12
charts/ingress-nginx/tests/admission-webhooks/job-patch/job-patchWebhook_test.yaml Normal file
View file

@ -0,0 +1,12 @@
suite: Admission Webhooks > Patch Job > Patch Webhook Job
templates:
- admission-webhooks/job-patch/job-patchWebhook.yaml
tests:
- it: should create a Job with token auto-mounting disabled if `controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken` is false
set:
controller.admissionWebhooks.patch.serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

9
charts/ingress-nginx/tests/controller-daemonset_test.yaml
View file

@ -190,3 +190,12 @@ tests:
- equal:
path: spec.template.spec.containers[0].image
value: registry.k8s.io/ingress-nginx/controller:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a DaemonSet with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false
set:
controller.kind: DaemonSet
serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

8
charts/ingress-nginx/tests/controller-deployment_test.yaml
View file

@ -215,3 +215,11 @@ tests:
- equal:
path: spec.progressDeadlineSeconds
value: 111
- it: should create a Deployment with token auto-mounting disabled if `serviceAccount.automountServiceAccountToken` is false
set:
serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false

9
charts/ingress-nginx/tests/default-backend-deployment_test.yaml
View file

@ -187,3 +187,12 @@ tests:
- equal:
path: spec.template.spec.containers[0].image
value: registry.k8s.io/defaultbackend-amd64:custom-tag@sha256:faa2d18687f734994b6bd9e309e7a73852a81c30e1b8f63165fcd4f0a087e3cd
- it: should create a Deployment with token auto-mounting disabled if `defaultBackend.serviceAccount.automountServiceAccountToken` is false
set:
defaultBackend.enabled: true
defaultBackend.serviceAccount.automountServiceAccountToken: false
asserts:
- equal:
path: spec.template.spec.automountServiceAccountToken
value: false