Add service account (#24)

* Add service account

* Bump version

charts/beekeeper/Chart.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 appVersion: latest
 name: beekeeper
-version: 0.1.1
+version: 0.1.2
 description: Ethereum Swarm Beekeeper Helm chart for Kubernetes
 home: https://swarm.ethereum.org
 icon: https://swarm-guide.readthedocs.io/en/latest/_images/swarm.png

charts/beekeeper/templates/clusterrole.yaml

@@ -0,0 +1,82 @@
+{{- if and .Values.serviceAccount.create .Values.serviceAccount.createClusterRole -}}
+---
+kind: ClusterRole
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  labels:
+{{ include "beekeeper.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources:
+  - services
+  - events
+  - namespaces
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["endpoints"]
+  verbs: ["create", "get", "list", "watch", "update"]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch", "create", "update", "delete"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "create", "update", "delete"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch","update", "delete"]
+- apiGroups: ["apps"]
+  resources: ["statefulsets"]
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["nodes"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs: ["get", "list", "watch", "patch","update"]
+- apiGroups: ["certificates.k8s.io"]
+  resources: ["certificatesigningrequests", "certificatesigningrequests/approval"]
+  verbs: ["get", "delete", "create", "update"]
+- apiGroups: ["certificates.k8s.io"]
+  resources:
+    - "signers"
+  resourceNames:
+    - "kubernetes.io/legacy-unknown"
+  verbs: ["approve"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "create", "list", "watch", "update", "delete"]
+- apiGroups: ["admissionregistration.k8s.io"]
+  resources: ["mutatingwebhookconfigurations","validatingwebhookconfigurations"]
+  verbs: ["get", "create", "delete", "update", "patch"]
+- apiGroups: ["pingcap.com"]
+  resources:
+    - podchaos
+    - networkchaos
+    - iochaos
+    - timechaos
+    - kernelchaos
+    - stresschaos
+  verbs: ["*"]
+---
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  labels:
+{{ include "beekeeper.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}

charts/beekeeper/templates/fileretrieval.yaml

@@ -18,6 +18,7 @@ spec:
     spec:
       template:
         spec:
+          serviceAccountName: {{ include "beekeeper.serviceAccountName" . }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/beekeeper/templates/fileretrievalfull.yaml

@@ -18,6 +18,7 @@ spec:
     spec:
       template:
         spec:
+          serviceAccountName: {{ include "beekeeper.serviceAccountName" . }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/beekeeper/templates/pingpong.yaml

@@ -18,6 +18,7 @@ spec:
     spec:
       template:
         spec:
+          serviceAccountName: {{ include "beekeeper.serviceAccountName" . }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/beekeeper/templates/pushsync.yaml

@@ -18,6 +18,7 @@ spec:
     spec:
       template:
         spec:
+          serviceAccountName: {{ include "beekeeper.serviceAccountName" . }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/beekeeper/templates/pushsyncchunks.yaml

@@ -18,6 +18,7 @@ spec:
     spec:
       template:
         spec:
+          serviceAccountName: {{ include "beekeeper.serviceAccountName" . }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/beekeeper/templates/retrieval.yaml

@@ -18,6 +18,7 @@ spec:
     spec:
       template:
         spec:
+          serviceAccountName: {{ include "beekeeper.serviceAccountName" . }}
           containers:
             - name: {{ .Chart.Name }}
               image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"

charts/beekeeper/templates/role.yaml

@@ -0,0 +1,59 @@
+{{- if and .Values.serviceAccount.create .Values.serviceAccount.createRole -}}
+---
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  labels:
+{{ include "beekeeper.labels" . | nindent 4 }}
+rules:
+- apiGroups: [""]
+  resources:
+    - services
+    - events
+    - namespaces
+  verbs: ["*"]
+- apiGroups: [""]
+  resources: ["endpoints"]
+  verbs: ["create", "get", "list", "watch", "update"]
+- apiGroups: ["batch"]
+  resources: ["jobs"]
+  verbs: ["get", "list", "watch", "create", "update", "delete"]
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "create", "update", "delete"]
+- apiGroups: [""]
+  resources: ["pods"]
+  verbs: ["get", "list", "watch","update", "delete"]
+- apiGroups: ["apps"]
+  resources: ["statefulsets"]
+  verbs: ["*"]
+- apiGroups: ["pingcap.com"]
+  resources:
+  - podchaos
+  - networkchaos
+  - iochaos
+  - timechaos
+  - kernelchaos
+  - stresschaos
+  verbs: ["*"]
+---
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1beta1
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  labels:
+{{ include "beekeeper.labels" . | nindent 4 }}
+subjects:
+- kind: ServiceAccount
+  name: {{ include "beekeeper.serviceAccountName" . }}
+roleRef:
+  kind: Role
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  apiGroup: rbac.authorization.k8s.io
+{{- end -}}

charts/beekeeper/templates/serviceaccount.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.serviceAccount.create -}}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  namespace: {{ .Release.Namespace }}
+  name: {{ include "beekeeper.serviceAccountName" . }}
+  labels:
+{{ include "beekeeper.labels" . | nindent 4 }}
+{{- end -}}

charts/beekeeper/values.yaml

@@ -7,6 +7,16 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+serviceAccount:
+  ## Specifies whether a service account should be created
+  create: false
+  ## Name of the service account to use
+  ## if not set and create is true, a name is generated using the fullname template
+  name:
+  ## create role or/and cluster role for the service account
+  createRole: false
+  createClusterRole: false
+
 nodeSelector: {}
 
 beeCluster: