Skip to content

Commit ef0689b

Browse files
IntuinewinIntuinewin
authored
firezone: service account per component (#24)
* firezone: reorganize into subfolders * firezone: add a service account per component * firezone: fix service account name * firezone: fix service account name * firezone: fix service account name * firezone: fix fullname templates * firezone: fix service account name * firezone: bump chart version
1 parent ad46eae commit ef0689b

26 files changed

+189
-55
lines changed

‎firezone/Chart.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
apiVersion: v2
22
name: firezone
3-
version: 0.8.0
3+
version: 0.8.1
44
appVersion: 7c2796c71676fcd506d8ccc87b8fd89198ccff24
55
type: application
66
description: A Helm chart for deploying firezone

‎firezone/templates/_helpers.tpl

-11
Original file line numberDiff line numberDiff line change
@@ -128,14 +128,3 @@ Common env secrets
128128
name: {{ required "Missing `firezone.email.opts.secret`" .Values.global.email.opts.secret }}
129129
key: {{ required "Missing `firezone.email.opts.key`" .Values.global.email.opts.key }}
130130
{{- end }}
131-
132-
{{/*
133-
Create the name of the service account to use
134-
*/}}
135-
{{- define "firezone.serviceAccountName" -}}
136-
{{- if .Values.serviceAccount.create }}
137-
{{- default (include "firezone.fullname" .) .Values.serviceAccount.name }}
138-
{{- else }}
139-
{{- default "default" .Values.serviceAccount.name }}
140-
{{- end }}
141-
{{- end }}

‎firezone/templates/_api_helpers.tpl renamed to ‎firezone/templates/api/_helpers.tpl

+15
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
{{- define "firezone.api.fullname" -}}
2+
{{- printf "%s-%s" (include "firezone.fullname" $) "api" -}}
3+
{{- end }}
4+
15
{{/*
26
Api Common labels
37
*/}}
@@ -18,3 +22,14 @@ app.kubernetes.io/name: {{ include "firezone.name" . }}
1822
app.kubernetes.io/component: api
1923
app.kubernetes.io/instance: {{ .Release.Name }}
2024
{{- end }}
25+
26+
{{/*
27+
Create the name of the service account to use
28+
*/}}
29+
{{- define "firezone.api.serviceAccountName" -}}
30+
{{- if or (.Values.api.serviceAccount.create) (.Values.global.erlangCluster.enableKubernetesClusterModule) }}
31+
{{- default (include "firezone.api.fullname" .) .Values.api.serviceAccount.name }}
32+
{{- else }}
33+
{{- default "default" .Values.api.serviceAccount.name }}
34+
{{- end }}
35+
{{- end }}

‎firezone/templates/api-deployment.yaml renamed to ‎firezone/templates/api/deployment.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: apps/v1
22
kind: Deployment
33
metadata:
4-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "api" }}
4+
name: {{ include "firezone.api.fullname" . }}
55
labels:
66
{{- include "firezone.api.labels" . | nindent 4 }}
77
spec:
@@ -29,7 +29,7 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32-
serviceAccountName: {{ include "firezone.serviceAccountName" . }}
32+
serviceAccountName: {{ include "firezone.api.serviceAccountName" . }}
3333
securityContext:
3434
{{- toYaml .Values.api.podSecurityContext | nindent 8 }}
3535
containers:

‎firezone/templates/api-hpa.yaml renamed to ‎firezone/templates/api/hpa.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
apiVersion: autoscaling/v2
33
kind: HorizontalPodAutoscaler
44
metadata:
5-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "api" }}
5+
name: {{ include "firezone.api.fullname" . }}
66
labels:
77
{{- include "firezone.api.labels" . | nindent 4 }}
88
spec:
99
scaleTargetRef:
1010
apiVersion: apps/v1
1111
kind: Deployment
12-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "api" }}
12+
name: {{ include "firezone.api.fullname" . }}
1313
minReplicas: {{ .Values.api.autoscaling.minReplicas }}
1414
maxReplicas: {{ .Values.api.autoscaling.maxReplicas }}
1515
metrics:

‎firezone/templates/api-ingress.yaml renamed to ‎firezone/templates/api/ingress.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- if .Values.api.ingress.enabled -}}
2-
{{- $fullName := printf "%s-%s" (include "firezone.fullname" $) "api" -}}
2+
{{- $fullName := include "firezone.api.fullname" . -}}
33
{{- $svcPort := .Values.api.service.port -}}
44
apiVersion: networking.k8s.io/v1
55
kind: Ingress

‎firezone/templates/role.yaml renamed to ‎firezone/templates/api/role.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
apiVersion: rbac.authorization.k8s.io/v1
33
kind: Role
44
metadata:
5-
name: {{ include "firezone.serviceAccountName" . }}
5+
name: {{ include "firezone.api.serviceAccountName" . }}
66
rules:
77
- apiGroups:
88
- ""

‎firezone/templates/rolebinding.yaml renamed to ‎firezone/templates/api/rolebinding.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22
apiVersion: rbac.authorization.k8s.io/v1
33
kind: RoleBinding
44
metadata:
5-
name: {{ include "firezone.serviceAccountName" . }}
5+
name: {{ include "firezone.api.serviceAccountName" . }}
66
roleRef:
77
apiGroup: rbac.authorization.k8s.io
88
kind: Role
9-
name: {{ include "firezone.serviceAccountName" . }}
9+
name: {{ include "firezone.api.serviceAccountName" . }}
1010
subjects:
1111
- kind: ServiceAccount
12-
name: {{ include "firezone.serviceAccountName" . }}
12+
name: {{ include "firezone.api.serviceAccountName" . }}
1313
{{- end }}

‎firezone/templates/api-service.yaml renamed to ‎firezone/templates/api/service.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "api" }}
4+
name: {{ include "firezone.api.fullname" . }}
55
labels:
66
{{- include "firezone.api.labels" . | nindent 4 }}
77
{{ .Values.global.erlangCluster.kubernetes.selector.key }}: {{ .Values.global.erlangCluster.kubernetes.selector.value }}

‎firezone/templates/api/serviceaccount.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if or (.Values.api.serviceAccount.create) (.Values.global.erlangCluster.enableKubernetesClusterModule) -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "firezone.api.serviceAccountName" . }}
6+
labels:
7+
{{- include "firezone.labels" . | nindent 4 }}
8+
{{- with .Values.api.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
automountServiceAccountToken: {{ .Values.api.serviceAccount.automount }}
13+
{{- end }}

‎firezone/templates/_domain_helpers.tpl renamed to ‎firezone/templates/domain/_helpers.tpl

+15
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
{{- define "firezone.domain.fullname" -}}
2+
{{- printf "%s-%s" (include "firezone.fullname" $) "domain" -}}
3+
{{- end }}
4+
15
{{/*
26
Domain Common labels
37
*/}}
@@ -18,3 +22,14 @@ app.kubernetes.io/name: {{ include "firezone.name" . }}
1822
app.kubernetes.io/component: domain
1923
app.kubernetes.io/instance: {{ .Release.Name }}
2024
{{- end }}
25+
26+
{{/*
27+
Create the name of the service account to use
28+
*/}}
29+
{{- define "firezone.domain.serviceAccountName" -}}
30+
{{- if or (.Values.domain.serviceAccount.create) (.Values.global.erlangCluster.enableKubernetesClusterModule) }}
31+
{{- default (include "firezone.domain.fullname" .) .Values.domain.serviceAccount.name }}
32+
{{- else }}
33+
{{- default "default" .Values.domain.serviceAccount.name }}
34+
{{- end }}
35+
{{- end }}

‎firezone/templates/domain-deployment.yaml renamed to ‎firezone/templates/domain/deployment.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: apps/v1
22
kind: Deployment
33
metadata:
4-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "domain" }}
4+
name: {{ include "firezone.domain.fullname" . }}
55
labels:
66
{{- include "firezone.domain.labels" . | nindent 4 }}
77
spec:
@@ -29,7 +29,7 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32-
serviceAccountName: {{ include "firezone.serviceAccountName" . }}
32+
serviceAccountName: {{ include "firezone.domain.serviceAccountName" . }}
3333
securityContext:
3434
{{- toYaml .Values.domain.podSecurityContext | nindent 8 }}
3535
containers:

‎firezone/templates/domain-hpa.yaml renamed to ‎firezone/templates/domain/hpa.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
apiVersion: autoscaling/v2
33
kind: HorizontalPodAutoscaler
44
metadata:
5-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "domain" }}
5+
name: {{ include "firezone.domain.fullname" . }}
66
labels:
77
{{- include "firezone.domain.labels" . | nindent 4 }}
88
spec:
99
scaleTargetRef:
1010
apiVersion: apps/v1
1111
kind: Deployment
12-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "domain" }}
12+
name: {{ include "firezone.domain.fullname" . }}
1313
minReplicas: {{ .Values.domain.autoscaling.minReplicas }}
1414
maxReplicas: {{ .Values.domain.autoscaling.maxReplicas }}
1515
metrics:

‎firezone/templates/domain/role.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.global.erlangCluster.enableKubernetesClusterModule -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "firezone.domain.serviceAccountName" . }}
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- endpoints
11+
verbs:
12+
- list
13+
{{- end }}

‎firezone/templates/domain/rolebinding.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.global.erlangCluster.enableKubernetesClusterModule -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "firezone.domain.serviceAccountName" . }}
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: {{ include "firezone.domain.serviceAccountName" . }}
10+
subjects:
11+
- kind: ServiceAccount
12+
name: {{ include "firezone.domain.serviceAccountName" . }}
13+
{{- end }}

‎firezone/templates/domain/serviceaccount.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if or (.Values.domain.serviceAccount.create) (.Values.global.erlangCluster.enableKubernetesClusterModule) -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "firezone.domain.serviceAccountName" . }}
6+
labels:
7+
{{- include "firezone.labels" . | nindent 4 }}
8+
{{- with .Values.domain.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
automountServiceAccountToken: {{ .Values.domain.serviceAccount.automount }}
13+
{{- end }}

‎firezone/templates/serviceaccount.yaml

-13
This file was deleted.

‎firezone/templates/_web_helpers.tpl renamed to ‎firezone/templates/web/_helpers.tpl

+15
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
{{- define "firezone.web.fullname" -}}
2+
{{- printf "%s-%s" (include "firezone.fullname" $) "web" -}}
3+
{{- end }}
4+
15
{{/*
26
Web Common labels
37
*/}}
@@ -18,3 +22,14 @@ app.kubernetes.io/name: {{ include "firezone.name" . }}
1822
app.kubernetes.io/component: web
1923
app.kubernetes.io/instance: {{ .Release.Name }}
2024
{{- end }}
25+
26+
{{/*
27+
Create the name of the service account to use
28+
*/}}
29+
{{- define "firezone.web.serviceAccountName" -}}
30+
{{- if or (.Values.domain.serviceAccount.create) (.Values.global.erlangCluster.enableKubernetesClusterModule) }}
31+
{{- default (include "firezone.web.fullname" .) .Values.web.serviceAccount.name }}
32+
{{- else }}
33+
{{- default "default" .Values.web.serviceAccount.name }}
34+
{{- end }}
35+
{{- end }}

‎firezone/templates/web-deployment.yaml renamed to ‎firezone/templates/web/deployment.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: apps/v1
22
kind: Deployment
33
metadata:
4-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "web" }}
4+
name: {{ include "firezone.web.fullname" . }}
55
labels:
66
{{- include "firezone.web.labels" . | nindent 4 }}
77
spec:
@@ -29,7 +29,7 @@ spec:
2929
imagePullSecrets:
3030
{{- toYaml . | nindent 8 }}
3131
{{- end }}
32-
serviceAccountName: {{ include "firezone.serviceAccountName" . }}
32+
serviceAccountName: {{ include "firezone.web.serviceAccountName" . }}
3333
securityContext:
3434
{{- toYaml .Values.web.podSecurityContext | nindent 8 }}
3535
containers:

‎firezone/templates/web-hpa.yaml renamed to ‎firezone/templates/web/hpa.yaml

+2-2
Original file line numberDiff line numberDiff line change
@@ -2,14 +2,14 @@
22
apiVersion: autoscaling/v2
33
kind: HorizontalPodAutoscaler
44
metadata:
5-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "web" }}
5+
name: {{ include "firezone.web.fullname" . }}
66
labels:
77
{{- include "firezone.web.labels" . | nindent 4 }}
88
spec:
99
scaleTargetRef:
1010
apiVersion: apps/v1
1111
kind: Deployment
12-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "web" }}
12+
name: {{ include "firezone.web.fullname" . }}
1313
minReplicas: {{ .Values.web.autoscaling.minReplicas }}
1414
maxReplicas: {{ .Values.web.autoscaling.maxReplicas }}
1515
metrics:

‎firezone/templates/web-ingress.yaml renamed to ‎firezone/templates/web/ingress.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{{- if .Values.web.ingress.enabled -}}
2-
{{- $fullName := printf "%s-%s" (include "firezone.fullname" $) "web" -}}
2+
{{- $fullName := include "firezone.web.fullname" . -}}
33
{{- $svcPort := .Values.web.service.port -}}
44
apiVersion: networking.k8s.io/v1
55
kind: Ingress

‎firezone/templates/web/role.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.global.erlangCluster.enableKubernetesClusterModule -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: Role
4+
metadata:
5+
name: {{ include "firezone.web.serviceAccountName" . }}
6+
rules:
7+
- apiGroups:
8+
- ""
9+
resources:
10+
- endpoints
11+
verbs:
12+
- list
13+
{{- end }}

‎firezone/templates/web/rolebinding.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if .Values.global.erlangCluster.enableKubernetesClusterModule -}}
2+
apiVersion: rbac.authorization.k8s.io/v1
3+
kind: RoleBinding
4+
metadata:
5+
name: {{ include "firezone.web.serviceAccountName" . }}
6+
roleRef:
7+
apiGroup: rbac.authorization.k8s.io
8+
kind: Role
9+
name: {{ include "firezone.web.serviceAccountName" . }}
10+
subjects:
11+
- kind: ServiceAccount
12+
name: {{ include "firezone.web.serviceAccountName" . }}
13+
{{- end }}

‎firezone/templates/web-service.yaml renamed to ‎firezone/templates/web/service.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
apiVersion: v1
22
kind: Service
33
metadata:
4-
name: {{ printf "%s-%s" (include "firezone.fullname" $) "web" }}
4+
name: {{ include "firezone.web.fullname" . }}
55
labels:
66
{{- include "firezone.web.labels" . | nindent 4 }}
77
{{ .Values.global.erlangCluster.kubernetes.selector.key }}: {{ .Values.global.erlangCluster.kubernetes.selector.value }}

‎firezone/templates/web/serviceaccount.yaml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{{- if or (.Values.web.serviceAccount.create) (.Values.global.erlangCluster.enableKubernetesClusterModule) -}}
2+
apiVersion: v1
3+
kind: ServiceAccount
4+
metadata:
5+
name: {{ include "firezone.web.serviceAccountName" . }}
6+
labels:
7+
{{- include "firezone.labels" . | nindent 4 }}
8+
{{- with .Values.web.serviceAccount.annotations }}
9+
annotations:
10+
{{- toYaml . | nindent 4 }}
11+
{{- end }}
12+
automountServiceAccountToken: {{ .Values.web.serviceAccount.automount }}
13+
{{- end }}

0 commit comments

Comments
 (0)