[Application] Support existing ServiceAccount name

.github/workflows/conf/ct-test.yml

@@ -5,3 +5,4 @@ all: true
 debug: true
 check-version-increment: true
 helm-extra-args: '--timeout 120s'
+namespace: test

.github/workflows/pr-chart-lint-and-test.yml

@@ -43,10 +43,11 @@ jobs:
             echo "matrix<<EOF"
             echo '{ "include": ['
             [[ "${{ steps.changed-files.outputs.any_changed }}" == 'false' ]] && echo '{ "name": "lint" },'
-            echo '{ "name": "k8s-1.30", "kindest_image": "kindest/node:v1.30.0"  },'
-            echo '{ "name": "k8s-1.29", "kindest_image": "kindest/node:v1.29.4"  },'
-            echo '{ "name": "k8s-1.28", "kindest_image": "kindest/node:v1.28.9"  },'
-            echo '{ "name": "k8s-1.27", "kindest_image": "kindest/node:v1.27.13" },'
+            echo '{ "name": "k8s-1.31", "kindest_image": "kindest/node:v1.31.0"  },'
+            echo '{ "name": "k8s-1.30", "kindest_image": "kindest/node:v1.30.4"  },'
+            echo '{ "name": "k8s-1.29", "kindest_image": "kindest/node:v1.29.8"  },'
+            echo '{ "name": "k8s-1.28", "kindest_image": "kindest/node:v1.28.13"  },'
+            echo '{ "name": "k8s-1.27", "kindest_image": "kindest/node:v1.27.16" },'
             echo '{ "name": "k8s-1.26", "kindest_image": "kindest/node:v1.26.15" },'
             echo '{ "name": "k8s-1.25", "kindest_image": "kindest/node:v1.25.16" }'
             echo '] }'
@@ -60,7 +61,7 @@ jobs:
     if: ${{ needs.prep_job.outputs.has_changes == 'true' }}
     env:
       # see https://github.com/kubernetes-sigs/kind/releases
-      kind_version: v0.23.0
+      kind_version: v0.24.0
     strategy:
       matrix: ${{ fromJson(needs.prep_job.outputs.matrix) }}
     name: ${{ matrix.name }}

.github/workflows/scripts/chart-test-prep/preconditions.yaml

@@ -8,3 +8,14 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: flux-system
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: test
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: name-me-butterfly
+  namespace: test

chart-tests/application/ci/test-additional-port-values.yaml

@@ -5,20 +5,20 @@ resources:
   limits:
     cpu: 100m
     memory: 100Mi
-spec:
-  values:
-    container:
-      port: 8000
-    service:
-      port: 8000
-      backendConfig:
-        enabled: true
-        securityPolicyName: uri-path-policy
-    additionalPorts:
-      - name: https
-        protocol: TCP
-        containerPort: 8081
-        servicePort: 81
-      - name: grpc
-        protocol: TCP
-        containerPort: 8082
+container:
+  port: 8000
+service:
+  port: 8000
+  backendConfig:
+    enabled: true
+    securityPolicyName: uri-path-policy
+configuration:
+  HTTP_PORT: 8000
+additionalPorts:
+  - name: https
+    protocol: TCP
+    containerPort: 8081
+    servicePort: 81
+  - name: grpc
+    protocol: TCP
+    containerPort: 8082

chart-tests/application/ci/test-existing-service-account-values.yaml

@@ -0,0 +1,9 @@
+resources:
+  requests:
+    cpu: 10m
+    memory: 50Mi
+  limits:
+    cpu: 100m
+    memory: 100Mi
+serviceAccount:
+  existingServiceAccountName: name-me-butterfly

chart-tests/application/ci/test-resources-and-label-values.yaml

@@ -14,7 +14,7 @@ autoscaling:
 
 image:
   repository: quay.io/heubeck/examiner
-  tag: 1.13.1
+  tag: 1.13.3
   pullPolicy: IfNotPresent
 
   # ImagePolicy and check period for automated updates

chart-tests/application/ci/test-sidecar-values.yaml

@@ -14,7 +14,7 @@ sidecars:
   - name: sidekick
     image:
       repository: quay.io/heubeck/examiner
-      tag: 1.13.1
+      tag: 1.13.3
     env:
       ECHO_VALUE: yehaaa
       QUARKUS_HTTP_PORT: 9090
@@ -31,7 +31,7 @@ sidecars:
   - name: kickback
     image:
       repository: quay.io/heubeck/examiner
-      tag: 1.13.1
+      tag: 1.13.3
     env:
       ECHO_VALUE: wohooo
       QUARKUS_HTTP_PORT: 7070

chart-tests/application/ci/test-statefulset-sidecar-values.yaml

@@ -17,7 +17,7 @@ sidecars:
   - name: sidekick
     image:
       repository: quay.io/heubeck/examiner
-      tag: 1.13.1
+      tag: 1.13.3
     env:
       ECHO_VALUE: yehaaa
       QUARKUS_HTTP_PORT: 9090
@@ -34,7 +34,7 @@ sidecars:
   - name: kickback
     image:
       repository: quay.io/heubeck/examiner
-      tag: 1.13.1
+      tag: 1.13.3
     env:
       ECHO_VALUE: wohooo
       QUARKUS_HTTP_PORT: 7070

charts/application/Chart.yaml

@@ -7,4 +7,4 @@ maintainers:
   - name: MediaMarktSaturn
     url: https://github.com/MediaMarktSaturn
 appVersion: 1.0.0
-version: 1.23.0
+version: 1.24.0

charts/application/README.md

@@ -39,7 +39,7 @@ Generic application chart with common requirements of a typical workload.
 | readinessProbe.failureThreshold | int | `3` |  |
 | readinessProbe.timeoutSeconds | int | `5` |  |
 | image.repository | string | `"quay.io/heubeck/examiner"` |  |
-| image.tag | string | `"1.13.1"` |  |
+| image.tag | string | `"1.13.3"` |  |
 | image.digest | string | `nil` |  |
 | image.pullPolicy | string | `"IfNotPresent"` |  |
 | image.tagSemverRange | string | `nil` |  |

charts/application/templates/_helpers.tpl

@@ -39,3 +39,14 @@ Selector labels
 {{ include "commonLabels" . }}
 {{ include "selectorLabels" . }}
 {{- end -}}
+
+{{/*
+ServiceAccount name
+*/}}
+{{- define "serviceAccountName" -}}
+{{- if .Values.serviceAccount.existingServiceAccountName -}}
+{{- .Values.serviceAccount.existingServiceAccountName | quote -}}
+{{- else -}}
+{{- .Release.Name -}}
+{{- end -}}
+{{- end -}}

charts/application/templates/_podTemplate.tpl

@@ -21,7 +21,7 @@ metadata:
     {{- end }}
     {{- end }}
 spec:
-  serviceAccountName: {{ .Release.Name }}
+  serviceAccountName: {{ include "serviceAccountName" . }}
   {{- if .Values.podSecurityContext }}
   securityContext:
     {{- toYaml .Values.podSecurityContext | nindent 4 }}

charts/application/templates/k8s-service-account.yaml

@@ -1,7 +1,8 @@
+{{- if not .Values.serviceAccount.existingServiceAccountName }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Release.Name }}
+  name: {{ include "serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "labels" . | nindent 4 }}
@@ -10,3 +11,4 @@ metadata:
     iam.gke.io/gcp-service-account: {{ .Values.serviceAccount.workloadIdentityServiceAccount }}
   {{- end }}
 automountServiceAccountToken: {{ or .Values.serviceAccount.automountServiceAccountToken (not (empty .Values.serviceAccount.rbac)) }}
+{{- end }}

charts/application/values.yaml

@@ -55,7 +55,7 @@ readinessProbe:
 
 image:
   repository: quay.io/heubeck/examiner
-  tag: 1.13.1
+  tag: 1.13.3
   # When image.digest is set the image.tag, imagepolicy and imagerepository is ignored
   # e.g. "sha256:b187aed68cc8c75f475efe8aebcc61fc7ca0c5adc2d2c5b8318997c3edc8d32f"
   digest:
@@ -150,6 +150,14 @@ encryptedSecret:
   mountPath:
 
 serviceAccount:
+  # giving an `existingServiceAccountName` will map that one instead of creating a new one; the refered SA must already exist
+  ## you may want to manual set:
+  ## ```
+  ## nodeSelector:
+  ##   iam.gke.io/gke-metadata-server-enabled: "true"
+  ## ```
+  ## if using workload identity with your own SA (done automatically when using `workloadIdentityServiceAccount` for automatically created SA)
+  existingServiceAccountName:
   # service account email address for use with workload identity, see https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
   workloadIdentityServiceAccount:
   # secret containing a 'key.json' of the GCP service account key to be used by this app
@@ -268,7 +276,7 @@ prepJob:
   command: []
   # key/value pairs that will be bound as env
   configuration: {}
-  # pre-existing service account to be used
+  # pre-existing service account to be used (as automatically created one does not exist yet on-install of helm release)
   serviceAccountName:
   resources: {}
   #  requests:
@@ -311,7 +319,7 @@ sidecars: []
 # - name: sqlproxy
 #   image:
 #     repository: quay.io/heubeck/examiner
-#     tag: 1.13.1
+#     tag: 1.13.3
 #   args: []
 #   env: {}
 #   configEnvFrom: []