Nguyen Minh Phuc
50c2fe2a1e
ci / lint (push) Successful in 1m19s
ci / unit (push) Failing after 1m2s
ci / integration (push) Has been skipped
ci / types (push) Successful in 1m37s
ci / security (push) Failing after 38s
ci / dockerfile (push) Successful in 14s
ci / image (api) (push) Has been skipped
ci / image (reconciler) (push) Has been skipped
ci / image (worker) (push) Has been skipped
ci / bump (push) Has been skipped
Complete working build of the system learn-python/ teaches. 164 tests, mypy --strict clean, domain coverage 99%.
25 lines
902 B
YAML
25 lines
902 B
YAML
{{- if .Values.serviceAccount.create }}
|
|
{{/*
|
|
One ServiceAccount per service, not one shared. The api talks only to Postgres and has no
|
|
Kubernetes rights at all; giving it the worker's identity would hand an
|
|
internet-facing HTTP surface the ability to create namespaces.
|
|
*/}}
|
|
{{- range $component := list "api" "worker" "reconciler" }}
|
|
---
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: {{ include "svcforge.serviceAccountName" (dict "ctx" $ "component" $component) }}
|
|
labels:
|
|
{{- include "svcforge.labels" $ | nindent 4 }}
|
|
app.kubernetes.io/component: {{ $component }}
|
|
{{- with $.Values.serviceAccount.annotations }}
|
|
annotations:
|
|
{{- toYaml . | nindent 4 }}
|
|
{{- end }}
|
|
# The api never calls the API server, so it gets no token. The worker and reconciler both
|
|
# shell out to helm, which needs one.
|
|
automountServiceAccountToken: {{ ne $component "api" }}
|
|
{{- end }}
|
|
{{- end }}
|