From 144368a598b7d140224ea69d9ceca73adacd8b96 Mon Sep 17 00:00:00 2001 From: Joshua Stern Date: Mon, 1 Mar 2021 18:05:29 -0500 Subject: [PATCH] Add automountServiceAccountToken field to ca service accounts Signed-off-by: Joshua Stern --- deploy/charts/cert-manager/README.template.md | 3 +++ .../cert-manager/templates/cainjector-serviceaccount.yaml | 1 + deploy/charts/cert-manager/templates/serviceaccount.yaml | 1 + .../cert-manager/templates/webhook-serviceaccount.yaml | 1 + deploy/charts/cert-manager/values.yaml | 6 ++++++ 5 files changed, 12 insertions(+) diff --git a/deploy/charts/cert-manager/README.template.md b/deploy/charts/cert-manager/README.template.md index a6515327d..809ba528c 100644 --- a/deploy/charts/cert-manager/README.template.md +++ b/deploy/charts/cert-manager/README.template.md @@ -95,6 +95,7 @@ The following table lists the configurable parameters of the cert-manager chart | `serviceAccount.create` | If `true`, create a new service account | `true` | | `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the fullname template | | | `serviceAccount.annotations` | Annotations to add to the service account | | +| `serviceAccount.automountServiceAccountToken` | Automount API credentials for the Service Account | `true` | | `volumes` | Optional volumes for cert-manager | `[]` | | `volumeMounts` | Optional volume mounts for cert-manager | `[]` | | `resources` | CPU/memory resource requests/limits | `{}` | @@ -135,6 +136,7 @@ The following table lists the configurable parameters of the cert-manager chart | `webhook.serviceAccount.create` | If `true`, create a new service account for the webhook component | `true` | | `webhook.serviceAccount.name` | Service account for the webhook component to be used. If not set and `webhook.serviceAccount.create` is `true`, a name is generated using the fullname template | | | `webhook.serviceAccount.annotations` | Annotations to add to the service account for the webhook component | | +| `webhook.serviceAccount.automountServiceAccountToken` | Automount API credentials for the webhook Service Account | | | `webhook.resources` | CPU/memory resource requests/limits for the webhook pods | `{}` | | `webhook.nodeSelector` | Node labels for webhook pod assignment | `{}` | | `webhook.affinity` | Node affinity for webhook pod assignment | `{}` | @@ -165,6 +167,7 @@ The following table lists the configurable parameters of the cert-manager chart | `cainjector.serviceAccount.create` | If `true`, create a new service account for the cainjector component | `true` | | `cainjector.serviceAccount.name` | Service account for the cainjector component to be used. If not set and `cainjector.serviceAccount.create` is `true`, a name is generated using the fullname template | | | `cainjector.serviceAccount.annotations` | Annotations to add to the service account for the cainjector component | | +| `cainjector.serviceAccount.automountServiceAccountToken` | Automount API credentials for the cainjector Service Account | `true` | | `cainjector.resources` | CPU/memory resource requests/limits for the cainjector pods | `{}` | | `cainjector.nodeSelector` | Node labels for cainjector pod assignment | `{}` | | `cainjector.affinity` | Node affinity for cainjector pod assignment | `{}` | diff --git a/deploy/charts/cert-manager/templates/cainjector-serviceaccount.yaml b/deploy/charts/cert-manager/templates/cainjector-serviceaccount.yaml index 3fcf69da5..f981e9518 100644 --- a/deploy/charts/cert-manager/templates/cainjector-serviceaccount.yaml +++ b/deploy/charts/cert-manager/templates/cainjector-serviceaccount.yaml @@ -2,6 +2,7 @@ {{- if .Values.cainjector.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount +automountServiceAccountToken: {{ .Values.cainjector.serviceAccount.automountServiceAccountToken }} metadata: name: {{ template "cainjector.serviceAccountName" . }} namespace: {{ .Release.Namespace | quote }} diff --git a/deploy/charts/cert-manager/templates/serviceaccount.yaml b/deploy/charts/cert-manager/templates/serviceaccount.yaml index 59c2f75f9..05a4ae965 100644 --- a/deploy/charts/cert-manager/templates/serviceaccount.yaml +++ b/deploy/charts/cert-manager/templates/serviceaccount.yaml @@ -4,6 +4,7 @@ kind: ServiceAccount {{- if .Values.global.imagePullSecrets }} imagePullSecrets: {{ toYaml .Values.global.imagePullSecrets | nindent 2 }} {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} metadata: name: {{ template "cert-manager.serviceAccountName" . }} namespace: {{ .Release.Namespace | quote }} diff --git a/deploy/charts/cert-manager/templates/webhook-serviceaccount.yaml b/deploy/charts/cert-manager/templates/webhook-serviceaccount.yaml index 128651c58..cde326145 100644 --- a/deploy/charts/cert-manager/templates/webhook-serviceaccount.yaml +++ b/deploy/charts/cert-manager/templates/webhook-serviceaccount.yaml @@ -1,6 +1,7 @@ {{- if .Values.webhook.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount +automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automountServiceAccountToken }} metadata: name: {{ template "webhook.serviceAccountName" . }} namespace: {{ .Release.Namespace | quote }} diff --git a/deploy/charts/cert-manager/values.yaml b/deploy/charts/cert-manager/values.yaml index 9f5bb85cc..5dfcb0141 100644 --- a/deploy/charts/cert-manager/values.yaml +++ b/deploy/charts/cert-manager/values.yaml @@ -80,6 +80,8 @@ serviceAccount: # name: "" # Optional additional annotations to add to the controller's ServiceAccount # annotations: {} + # Automount API credentials for a Service Account. + automountServiceAccountToken: true # Optional additional arguments extraArgs: [] @@ -280,6 +282,8 @@ webhook: # name: "" # Optional additional annotations to add to the controller's ServiceAccount # annotations: {} + # Automount API credentials for a Service Account. + automountServiceAccountToken: true # The port that the webhook should listen on for requests. # In GKE private clusters, by default kubernetes apiservers are allowed to @@ -367,3 +371,5 @@ cainjector: # name: "" # Optional additional annotations to add to the controller's ServiceAccount # annotations: {} + # Automount API credentials for a Service Account. + automountServiceAccountToken: true