FlowForge helm: 1. Editors: service account. 2. Broker: propagate ingress. 3. README

helm/flowforge/README.md

@@ -121,3 +121,20 @@ Enables FlowForge Telemetry
  ### Ingress
  - `ingress.annotations` ingress annotations (default is `{}`). This value is also applied to Editor instances created by FlowForge.
  - `ingress.className` ingress class name (default is `"""`). This value is also applied to Editor instances created by FlowForge. 
+
+### Editors IAM
+   Provision default service account for Editors if `editors.serviceAccount.create` is `true`.
+
+- `editors.serviceAccount.create` flag, indicates whether default Editors service account is going to be provisioned.
+- `editors.serviceAccount.annotations` k8s service account annotations.
+- `editors.serviceAccount.name` name of the service account for Editors.
+
+Example for <i>AWS</i>:
+```yaml
+editors:
+  serviceAccount:
+    annotations:
+      eks.amazonaws.com/role-arn: arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}
+    create: true
+    name: editors
+```

helm/flowforge/templates/broker.yaml

@@ -131,7 +131,13 @@ metadata:
   labels:
     app: flowforge-broker
   annotations:
+  {{- if .Values.ingress.annotations }}
+    {{- toYaml .Values.ingress.annotations | nindent 4 }}
+  {{- end }}
 spec:
+  {{- if $.Values.ingress.className }}
+  ingressClassName: {{ $.Values.ingress.className }}
+  {{- end }}
   rules:
     - host: mqtt.{{ .Values.forge.domain }}
       http:

helm/flowforge/templates/deployment.yaml

@@ -36,6 +36,10 @@ spec:
         - name: INGRESS_CLASS_NAME
           value: {{ .Values.ingress.className }}
         {{- end }}
+        {{- if .Values.editors.serviceAccount }}
+        - name: EDITOR_SERVICE_ACCOUNT
+          value: {{ .Values.editors.serviceAccount.name }}
+        {{- end }}
         {{- if .Values.forge.projectDeploymentTolerations }}
         - name: DEPLOYMENT_TOLERATIONS
           value: {{ .Values.forge.projectDeploymentTolerations | toJson | quote }}

helm/flowforge/templates/service-account.yaml

@@ -9,11 +9,27 @@ metadata:
     eks.amazonaws.com/sts-regional-endpoints: "true"
   {{- end }}
   {{- end }}
+
+
+{{- if .Values.editors.serviceAccount.create }}
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.editors.serviceAccount.name }}
+  namespace: {{ .Values.forge.projectNamespace }}
+  {{- with .Values.editors.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  {{- end }}
+
+---
+
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
-  name: create-pod
+  name: {{ .Release.Name }}-create-pod
 rules:
 - apiGroups: [""]
   resources: ["pods", "pods/log", "pods/exec", "pods/status"]
@@ -45,5 +61,5 @@ subjects:
   namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
-  name: create-pod
+  name: {{ .Release.Name }}-create-pod
   apiGroup: rbac.authorization.k8s.io

helm/flowforge/values.yaml

@@ -1,18 +1,17 @@
 forge:
   dbUsername: forge
-  dbPassword: Zai1Wied
+  dbPassword: ""
   dbName: flowforge
   localPostgresql: true
   https: true
   projectNamespace: flowforge
   projectSelector:
     role: projects
-
   projectDeploymentTolerations: []
-#    - key: purpose
-#      operator: Equal
-#      value: flowforge-projects
-#      effect: NoSchedule
+  #    - key: purpose
+  #      operator: Equal
+  #      value: flowforge-projects
+  #      effect: NoSchedule
   managementSelector:
     role: management
   telemetry:
@@ -32,17 +31,31 @@ forge:
         type: postgres
         host: flowforge-postgresql
         username: forge
-        password: Zai1Wied
+        password: ""
         database: ff-context
   support:
     enabled: false
 
+  domain: ""
+  entryPoint: ""
+  environment: {}
+  image: 355908013639.dkr.ecr.eu-west-1.amazonaws.com/flowforge/forge-k8s:1.5.0
+  registry: 355908013639.dkr.ecr.eu-west-1.amazonaws.com
+
 postgresql:
-  postgresqlPostgresPassword: Moomiet0
-  postgresqlUsername: forge
-  postgresqlPassword: Zai1Wied
   postgresqlDatabase: flowforge
+  postgresqlPassword: ""
+  postgresqlPostgresPassword: ""
+  postgresqlUsername: forge
+  global:
+    storageClass: default
 
 ingress:
   annotations: {}
   className: ""
+
+editors:
+  serviceAccount:
+    create: true
+    annotations: {}
+    name: editors