fix(blueprint): spinnaker halyard service account (#291)

* fix(blueprint): spinnaker halyard service account * fix(blueprint): rename the default spinnaker sa
Young-ook · Jun 20, 2023 · f4c9914 · f4c9914
1 parent 592ccba
commit f4c9914
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 28 deletions.
diff --git a/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/templates/rolebinding.yaml b/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/templates/rolebinding.yaml
diff --git a/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/templates/serviceaccount.yaml b/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/templates/serviceaccount.yaml
@@ -1,4 +1,32 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: halyard-sa
+  namespace: {{ .Release.Namespace }}
+  labels:
+{{ include "spinnaker.standard-labels" . | indent 4 }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: halyard
+  labels:
+{{ include "spinnaker.standard-labels" . | indent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: edit
+subjects:
+- namespace: {{ .Release.Namespace }}
+  kind: ServiceAccount
+  name: halyard-sa
+
+# Spinnaker service account
+# Currently, the halyard does not support to deploy spinnaker microservices
+# with custom kubernetes service account.
 {{- if .Values.serviceAccount.create }}
+---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -24,11 +52,7 @@ metadata:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
-  {{- if .Values.serviceAccount.name }}
-  name: {{ .Values.serviceAccount.name }}
-  {{- else }}
   name: {{ template "spinnaker.fullname" . }}
-  {{- end }}
   labels:
 {{ include "spinnaker.standard-labels" . | indent 4 }}
 roleRef:

diff --git a/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/templates/statefulset.yaml b/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/templates/statefulset.yaml
@@ -21,11 +21,7 @@ spec:
 {{ include "spinnaker.standard-labels" . | indent 8 }}
         component: halyard
     spec:
-      {{- if .Values.serviceAccount.name }}
-      serviceAccountName: {{ .Values.serviceAccount.name }}
-      {{- else }}
-      serviceAccountName: {{ template "spinnaker.fullname" . }}
-      {{- end }}
+      serviceAccountName: halyard-sa
       securityContext:
         runAsUser: {{ .Values.securityContext.runAsUser }}
         fsGroup: {{ .Values.securityContext.fsGroup }}

diff --git a/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/values.yaml b/examples/blueprint/modules/kubernetes-addons/charts/spinnaker/values.yaml
@@ -278,7 +278,7 @@ serviceAccount:
   create: true
   # The name of the ServiceAccounts to use.
   # If left blank it is auto-generated from the fullname of the release
-  name: spinnaker
+  name: spinnaker-sa
   annotations: {}
 
 securityContext: