Merge pull request #6555 from dokku/service-account

Add support for app-specific service accounts when deploying via k3s

plugins/scheduler-k3s/template.go

@@ -277,7 +277,8 @@ func templateKubernetesJob(input Job) (batchv1.Job, error) {
 							WorkingDir: input.WorkingDir,
 						},
 					},
-					RestartPolicy: corev1.RestartPolicyNever,
+					RestartPolicy:      corev1.RestartPolicyNever,
+					ServiceAccountName: input.AppName,
 				},
 			},
 		},

plugins/scheduler-k3s/templates/chart/cron-job.yaml

@@ -94,6 +94,7 @@ spec:
           imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }}
           {{- end }}
           restartPolicy: Never
+          serviceAccountName: {{ $.Values.global.app_name }}
   schedule: {{ $config.cron.schedule }}
   startingDeadlineSeconds: 60
   successfulJobsHistoryLimit: 10

plugins/scheduler-k3s/templates/chart/deployment.yaml

@@ -100,3 +100,4 @@ spec:
       {{- if $.Values.global.image.image_pull_secrets }}
       imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }}
       {{- end }}
+      serviceAccountName: {{ $.Values.global.app_name }}

plugins/scheduler-k3s/templates/chart/secret.yaml

@@ -13,4 +13,4 @@ metadata:
 {{- with .Values.global.secrets }}
 data:
   {{- toYaml . | nindent 2 }}
-{{- end }}
+{{- end }}

plugins/scheduler-k3s/templates/chart/service-account.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: service-account
+    app.kubernetes.io/name: service-account
+    app.kubernetes.io/part-of: "{{ $.Values.global.app_name }}"
+  name: "{{ $.Values.global.app_name }}"
+  namespace: "{{ $.Values.global.namespace }}"

plugins/scheduler-k3s/triggers.go

@@ -256,19 +256,22 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
 	}
 
 	deploymentId := time.Now().Unix()
-	b, err := templates.ReadFile("templates/chart/secret.yaml")
-	if err != nil {
-		return fmt.Errorf("Error reading secret template: %w", err)
-	}
+	globalTemplateFiles := []string{"service-account", "secret"}
+	for _, templateName := range globalTemplateFiles {
+		b, err := templates.ReadFile(fmt.Sprintf("templates/chart/%s.yaml", templateName))
+		if err != nil {
+			return fmt.Errorf("Error reading %s template: %w", templateName, err)
+		}
 
-	filename := filepath.Join(chartDir, "templates", "secrets.yaml")
-	err = os.WriteFile(filename, b, os.FileMode(0644))
-	if err != nil {
-		return fmt.Errorf("Error writing secrets template: %w", err)
-	}
+		filename := filepath.Join(chartDir, "templates", fmt.Sprintf("%s.yaml", templateName))
+		err = os.WriteFile(filename, b, os.FileMode(0644))
+		if err != nil {
+			return fmt.Errorf("Error writing %s template: %w", templateName, err)
+		}
 
-	if os.Getenv("DOKKU_TRACE") == "1" {
-		common.CatFile(filename)
+		if os.Getenv("DOKKU_TRACE") == "1" {
+			common.CatFile(filename)
+		}
 	}
 
 	portMaps, err := getPortMaps(appName)