github/dokku
0
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Merge pull request #6555 from dokku/service-account

Browse Source 
Add support for app-specific service accounts when deploying via k3s
This commit is contained in:
Jose Diaz-Gonzalez
2024-02-05 17:18:20 -05:00
committed by GitHub
parent 1689ddd6d3 d02c04c2a5
commit 6625846ecc
6 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
plugins/scheduler-k3s/template.go
View File

@@ -277,7 +277,8 @@ func templateKubernetesJob(input Job) (batchv1.Job, error) {
WorkingDir: input.WorkingDir, WorkingDir: input.WorkingDir,
}, },
}, },
RestartPolicy: corev1.RestartPolicyNever, RestartPolicy: corev1.RestartPolicyNever,
ServiceAccountName: input.AppName,
}, },
}, },
}, },

1
plugins/scheduler-k3s/templates/chart/cron-job.yaml
View File

@@ -94,6 +94,7 @@ spec:
imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }} imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }}
{{- end }} {{- end }}
restartPolicy: Never restartPolicy: Never
serviceAccountName: {{ $.Values.global.app_name }}
schedule: {{ $config.cron.schedule }} schedule: {{ $config.cron.schedule }}
startingDeadlineSeconds: 60 startingDeadlineSeconds: 60
successfulJobsHistoryLimit: 10 successfulJobsHistoryLimit: 10

1
plugins/scheduler-k3s/templates/chart/deployment.yaml
View File

@@ -100,3 +100,4 @@ spec:
{{- if $.Values.global.image.image_pull_secrets }} {{- if $.Values.global.image.image_pull_secrets }}
imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }} imagePullSecrets: {{ $.Values.global.image.image_pull_secrets }}
{{- end }} {{- end }}
serviceAccountName: {{ $.Values.global.app_name }}

2
plugins/scheduler-k3s/templates/chart/secret.yaml
View File

@@ -13,4 +13,4 @@ metadata:
{{- with .Values.global.secrets }} {{- with .Values.global.secrets }}
data: data:
{{- toYaml . | nindent 2 }} {{- toYaml . | nindent 2 }}
{{- end }} {{- end }}

9
plugins/scheduler-k3s/templates/chart/service-account.yaml Normal file
View File

@@ -0,0 +1,9 @@
apiVersion: v1
kind: ServiceAccount
metadata:
labels:
app.kubernetes.io/instance: service-account
app.kubernetes.io/name: service-account
app.kubernetes.io/part-of: "{{ $.Values.global.app_name }}"
name: "{{ $.Values.global.app_name }}"
namespace: "{{ $.Values.global.namespace }}"

25
plugins/scheduler-k3s/triggers.go
View File

@@ -256,19 +256,22 @@ func TriggerSchedulerDeploy(scheduler string, appName string, imageTag string) e
} }
deploymentId := time.Now().Unix() deploymentId := time.Now().Unix()
b, err := templates.ReadFile("templates/chart/secret.yaml") globalTemplateFiles := []string{"service-account", "secret"}
if err != nil { for _, templateName := range globalTemplateFiles {
return fmt.Errorf("Error reading secret template: %w", err) b, err := templates.ReadFile(fmt.Sprintf("templates/chart/%s.yaml", templateName))
} if err != nil {
return fmt.Errorf("Error reading %s template: %w", templateName, err)
}
filename := filepath.Join(chartDir, "templates", "secrets.yaml") filename := filepath.Join(chartDir, "templates", fmt.Sprintf("%s.yaml", templateName))
err = os.WriteFile(filename, b, os.FileMode(0644)) err = os.WriteFile(filename, b, os.FileMode(0644))
if err != nil { if err != nil {
return fmt.Errorf("Error writing secrets template: %w", err) return fmt.Errorf("Error writing %s template: %w", templateName, err)
} }
if os.Getenv("DOKKU_TRACE") == "1" { if os.Getenv("DOKKU_TRACE") == "1" {
common.CatFile(filename) common.CatFile(filename)
}
} }
portMaps, err := getPortMaps(appName) portMaps, err := getPortMaps(appName)