From d02c04c2a56681aa5615defc3375779052ca8a6a Mon Sep 17 00:00:00 2001
From: Jose Diaz-Gonzalez <email@josediazgonzalez.com>
Date: Mon, 5 Feb 2024 16:44:20 -0500
Subject: [PATCH] feat: add support for app-specific service accounts when
 deploying via k3s

Service accounts must still be bound to a role, but this ensures apps do not get access to the default service account.
---
 plugins/scheduler-k3s/template.go             |  3 ++-
 .../templates/chart/cron-job.yaml             |  1 +
 .../templates/chart/deployment.yaml           |  1 +
 .../scheduler-k3s/templates/chart/secret.yaml |  2 +-
 .../templates/chart/service-account.yaml      |  9 +++++++
 plugins/scheduler-k3s/triggers.go             | 25 +++++++++++--------
 6 files changed, 28 insertions(+), 13 deletions(-)
 create mode 100644 plugins/scheduler-k3s/templates/chart/service-account.yaml

diff --git a/plugins/scheduler-k3s/template.go b/plugins/scheduler-k3s/template.go
index 33bf03893..1960a3ad7 100644
--- a/plugins/scheduler-k3s/template.go
+++ b/plugins/scheduler-k3s/template.go
@@ -277,7 +277,8 @@ func templateKubernetesJob(input Job) (batchv1.Job, error) {
 							WorkingDir: input.WorkingDir,
 						},
 					},
-					RestartPolicy: corev1.RestartPolicyNever,
+					RestartPolicy:      corev1.RestartPolicyNever,
+					ServiceAccountName: input.AppName,
 				},
 			},
 		},
diff --git a/plugins/scheduler-k3s/templates/chart/cron-job.yaml b/plugins/scheduler-k3s/templates/chart/cron-job.yaml
index d34e14ef3..ee839aa02 100644
--- a/plugins/scheduler-k3s/templates/chart/cron-job.yaml
+++ b/plugins/scheduler-k3s/templates/chart/cron-job.yaml
@@ -94,6 +94,7 @@ spec:
           imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }}
           {{- end }}
           restartPolicy: Never
+          serviceAccountName: {{ $.Values.global.app_name }}
   schedule: {{ $config.cron.schedule }}
   startingDeadlineSeconds: 60
   successfulJobsHistoryLimit: 10
diff --git a/plugins/scheduler-k3s/templates/chart/deployment.yaml b/plugins/scheduler-k3s/templates/chart/deployment.yaml
index aa5ed713e..82595b78b 100644
--- a/plugins/scheduler-k3s/templates/chart/deployment.yaml
+++ b/plugins/scheduler-k3s/templates/chart/deployment.yaml
@@ -100,3 +100,4 @@ spec:
       {{- if $.Values.global.image.image_pull_secrets }}
       imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }}
       {{- end }}
+      serviceAccountName: {{ $.Values.global.app_name }}
diff --git a/plugins/scheduler-k3s/templates/chart/secret.yaml b/plugins/scheduler-k3s/templates/chart/secret.yaml
index a0115ac2b..d3f1e02ce 100644
--- a/plugins/scheduler-k3s/templates/chart/secret.yaml
+++ b/plugins/scheduler-k3s/templates/chart/secret.yaml
@@ -13,4 +13,4 @@ metadata:
 {{- with .Values.global.secrets }}
 data:
   {{- toYaml . | nindent 2 }}
-{{- end }}
\ No newline at end of file
+{{- end }}
diff --git a/plugins/scheduler-k3s/templates/chart/service-account.yaml b/plugins/scheduler-k3s/templates/chart/service-account.yaml
new file mode 100644
index 000000000..12cdc0717
--- /dev/null
+++ b/plugins/scheduler-k3s/templates/chart/service-account.yaml
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/instance: service-account
+    app.kubernetes.io/name: service-account
+    app.kubernetes.io/part-of: "{{ $.Values.global.app_name }}"
+  name: "{{ $.Values.global.app_name }}"
+  namespace: "{{ $.Values.global.namespace }}"
diff --git a/plugins/scheduler-k3s/triggers.go b/plugins/scheduler-k3s/triggers.go
index 8f88f9057..edfe21bb1 100644
--- a/plugins/scheduler-k3s/triggers.go
+++ b/plugins/scheduler-k3s/triggers.go
@@ -256,19 +256,22 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
 	}
 
 	deploymentId := time.Now().Unix()
-	b, err := templates.ReadFile("templates/chart/secret.yaml")
-	if err != nil {
-		return fmt.Errorf("Error reading secret template: %w", err)
-	}
+	globalTemplateFiles := []string{"service-account", "secret"}
+	for _, templateName := range globalTemplateFiles {
+		b, err := templates.ReadFile(fmt.Sprintf("templates/chart/%s.yaml", templateName))
+		if err != nil {
+			return fmt.Errorf("Error reading %s template: %w", templateName, err)
+		}
 
-	filename := filepath.Join(chartDir, "templates", "secrets.yaml")
-	err = os.WriteFile(filename, b, os.FileMode(0644))
-	if err != nil {
-		return fmt.Errorf("Error writing secrets template: %w", err)
-	}
+		filename := filepath.Join(chartDir, "templates", fmt.Sprintf("%s.yaml", templateName))
+		err = os.WriteFile(filename, b, os.FileMode(0644))
+		if err != nil {
+			return fmt.Errorf("Error writing %s template: %w", templateName, err)
+		}
 
-	if os.Getenv("DOKKU_TRACE") == "1" {
-		common.CatFile(filename)
+		if os.Getenv("DOKKU_TRACE") == "1" {
+			common.CatFile(filename)
+		}
 	}
 
 	portMaps, err := getPortMaps(appName)