From 9602a829f8aeb1d9ad525d967ede9c6e2c1d262c Mon Sep 17 00:00:00 2001 From: Gilles Gosuin Date: Wed, 11 Oct 2023 14:50:07 +0200 Subject: [PATCH] Allow opt-out of service account token automounting --- charts/external-dns/README.md | 130 +++++++++--------- charts/external-dns/templates/deployment.yaml | 3 + .../templates/serviceaccount.yaml | 3 + charts/external-dns/values.yaml | 6 + 4 files changed, 78 insertions(+), 64 deletions(-) diff --git a/charts/external-dns/README.md b/charts/external-dns/README.md index 4ea6f4fe74..910ca2aeff 100644 --- a/charts/external-dns/README.md +++ b/charts/external-dns/README.md @@ -20,70 +20,72 @@ helm upgrade --install external-dns external-dns/external-dns The following table lists the configurable parameters of the _ExternalDNS_ chart and their default values. -| Parameter | Description | Default | -|------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------| -| `image.repository` | Image repository. | `registry.k8s.io/external-dns/external-dns` | -| `image.tag` | Image tag, will override the default tag derived from the chart app version. | `""` | -| `image.pullPolicy` | Image pull policy. | `IfNotPresent` | -| `imagePullSecrets` | Image pull secrets. | `[]` | -| `nameOverride` | Override the `name` of the chart. | `""` | -| `fullnameOverride` | Override the `fullname` of the chart. | `""` | -| `serviceAccount.create` | If `true`, create a new `serviceaccount`. | `true` | -| `serviceAccount.annotations` | Annotations to add to the service account. | `{}` | -| `serviceAccount.labels` | Labels to add to the service account. | `{}` | -| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template. | `""` | -| `rbac.create` | If `true`, create the RBAC resources. | `true` | -| `rbac.additionalPermissions` | Additional permissions to be added to the cluster role. | `{}` | -| `initContainers` | Add init containers to the pod. | `[]` | -| `deploymentAnnotations` | Annotations to add to the Deployment. | `{}` | -| `podLabels` | Labels to add to the pod. | `{}` | -| `podAnnotations` | Annotations to add to the pod. | `{}` | -| `podSecurityContext` | Security context for the pod, this supports the full [PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core) API. | _see values.yaml_ | -| `shareProcessNamespace` | If `true` enable [Process Namespace Sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) | `false` | -| `securityContext` | Security context for the _external-dns_ container, this supports the full [SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#securitycontext-v1-core) API. | _see values.yaml_ | -| `priorityClassName` | Priority class name to use for the pod. | `""` | -| `terminationGracePeriodSeconds` | Termination grace period for the pod. | `null` | -| `serviceMonitor.enabled` | If `true`, create a _Prometheus_ service monitor. | `false` | -| `serviceMonitor.namespace` | Forced namespace for ServiceMonitor. | `null` | -| `serviceMonitor.annotations` | Annotations to be set on the ServiceMonitor. | `{}` | -| `serviceMonitor.additionalLabels` | Additional labels to be set on the ServiceMonitor. | `{}` | -| `serviceMonitor.interval` | _Prometheus_ scrape frequency. | `null` | -| `serviceMonitor.scrapeTimeout` | _Prometheus_ scrape timeout. | `null` | -| `serviceMonitor.scheme` | _Prometheus_ scrape scheme. | `null` | -| `serviceMonitor.tlsConfig` | _Prometheus_ scrape tlsConfig. | `{}` | -| `serviceMonitor.metricRelabelings` | _Prometheus_ scrape metricRelabelings. | `[]` | -| `serviceMonitor.relabelings` | _Prometheus_ scrape relabelings. | `[]` | -| `serviceMonitor.targetLabels` | _Prometheus_ scrape targetLabels. | `[]` | -| `env` | [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the _external-dns_ container, this supports the full [EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#envvar-v1-core) API including secrets and configmaps. | `[]` | -| `livenessProbe` | [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) for the _external-dns_ container, this supports the full [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#probe-v1-core) API. | See _values.yaml_ | -| `readinessProbe` | [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) for the _external-dns_ container, this supports the full [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#probe-v1-core) API. | See _values.yaml_ | -| `service.annotations` | Annotations to add to the service. | `{}` | -| `service.port` | Port to expose via the service. | `7979` | -| `extraVolumes` | Additional volumes for the pod, this supports the full [VolumeDevice](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#volumedevice-v1-core) API. | `[]` | -| `extraVolumeMounts` | Additional volume mounts for the _external-dns_ container, this supports the full [VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#volumemount-v1-core) API. | `[]` | -| `resources` | Resource requests and limits for the _external-dns_ container, this supports the full [ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#resourcerequirements-v1-core) API. | `{}` | -| `nodeSelector` | Node labels for pod assignment. | `{}` | -| `tolerations` | Tolerations for pod assignment, this supports the full [Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core) API. | `[]` | -| `affinity` | Affinity settings for pod assignment, this supports the full [Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#affinity-v1-core) API. | `{}` | -| `topologySpreadConstraints` | TopologySpreadConstraint settings for pod assignment, this supports the full [TopologySpreadConstraints](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#topologyspreadconstraint-v1-core) API. | `[]` | -| `logLevel` | Verbosity of the logs, available values are: `panic`, `debug`, `info`, `warning`, `error`, `fatal`. | `info` | -| `logFormat` | Formats of the logs, available values are: `text`, `json`. | `text` | -| `interval` | The interval for DNS updates. | `1m` | -| `triggerLoopOnEvent` | When enabled, triggers run loop on create/update/delete events in addition of regular interval. | `false` | -| `namespaced` | When enabled, external-dns runs on namespace scope. Additionally, Role and Rolebinding will be namespaced, too. | `false` | -| `sources` | K8s resources type to be observed for new DNS entries. | See _values.yaml_ | -| `policy` | How DNS records are synchronized between sources and providers, available values are: `sync`, `upsert-only`. | `upsert-only` | -| `registry` | Registry Type, available types are: `txt`, `noop`. | `txt` | -| `txtOwnerId` | TXT registry identifier. | `""` | -| `txtPrefix` | Prefix to create a TXT record with a name following the pattern `prefix.`. | `""` | -| `domainFilters` | Limit possible target zones by domain suffixes. | `[]` | -| `provider` | DNS provider where the DNS records will be created, for the available providers and how to configure them see the [README](https://github.com/kubernetes-sigs/external-dns#deploying-to-a-cluster) (this can be templated). | `aws` | -| `extraArgs` | Extra arguments to pass to the _external-dns_ container, these are needed for provider specific arguments (these can be templated). | `[]` | -| `deploymentStrategy` | .spec.strategy of the external-dns Deployment. Defaults to 'Recreate' since multiple external-dns pods may conflict with each other. | `{type: Recreate}` | -| `secretConfiguration.enabled` | Enable additional secret configuration. | `false` | -| `secretConfiguration.mountPath` | Mount path of secret configuration secret (this can be templated). | `""` | -| `secretConfiguration.data` | Secret configuration secret data. Could be used to store DNS provider credentials. | `{}` | -| `secretConfiguration.subPath` | Sub-path of secret configuration secret (this can be templated). | `""` | +| Parameter | Description | Default | +|-----------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------| +| `image.repository` | Image repository. | `registry.k8s.io/external-dns/external-dns` | +| `image.tag` | Image tag, will override the default tag derived from the chart app version. | `""` | +| `image.pullPolicy` | Image pull policy. | `IfNotPresent` | +| `imagePullSecrets` | Image pull secrets. | `[]` | +| `nameOverride` | Override the `name` of the chart. | `""` | +| `fullnameOverride` | Override the `fullname` of the chart. | `""` | +| `serviceAccount.create` | If `true`, create a new `serviceaccount`. | `true` | +| `serviceAccount.annotations` | Annotations to add to the service account. | `{}` | +| `serviceAccount.labels` | Labels to add to the service account. | `{}` | +| `serviceAccount.name` | Service account to be used. If not set and `serviceAccount.create` is `true`, a name is generated using the full name template. | `""` | +| `serviceAccount.automountServiceAccountToken` | Opt out of the [service account token automounting feature](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the service account | _see values.yaml_ | +| `rbac.create` | If `true`, create the RBAC resources. | `true` | +| `rbac.additionalPermissions` | Additional permissions to be added to the cluster role. | `{}` | +| `initContainers` | Add init containers to the pod. | `[]` | +| `deploymentAnnotations` | Annotations to add to the Deployment. | `{}` | +| `podLabels` | Labels to add to the pod. | `{}` | +| `podAnnotations` | Annotations to add to the pod. | `{}` | +| `podSecurityContext` | Security context for the pod, this supports the full [PodSecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#podsecuritycontext-v1-core) API. | _see values.yaml_ | +| `shareProcessNamespace` | If `true` enable [Process Namespace Sharing](https://kubernetes.io/docs/tasks/configure-pod-container/share-process-namespace/) | `false` | +| `securityContext` | Security context for the _external-dns_ container, this supports the full [SecurityContext](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#securitycontext-v1-core) API. | _see values.yaml_ | +| `priorityClassName` | Priority class name to use for the pod. | `""` | +| `terminationGracePeriodSeconds` | Termination grace period for the pod. | `null` | +| `serviceMonitor.enabled` | If `true`, create a _Prometheus_ service monitor. | `false` | +| `serviceMonitor.namespace` | Forced namespace for ServiceMonitor. | `null` | +| `serviceMonitor.annotations` | Annotations to be set on the ServiceMonitor. | `{}` | +| `serviceMonitor.additionalLabels` | Additional labels to be set on the ServiceMonitor. | `{}` | +| `serviceMonitor.interval` | _Prometheus_ scrape frequency. | `null` | +| `serviceMonitor.scrapeTimeout` | _Prometheus_ scrape timeout. | `null` | +| `serviceMonitor.scheme` | _Prometheus_ scrape scheme. | `null` | +| `serviceMonitor.tlsConfig` | _Prometheus_ scrape tlsConfig. | `{}` | +| `serviceMonitor.metricRelabelings` | _Prometheus_ scrape metricRelabelings. | `[]` | +| `serviceMonitor.relabelings` | _Prometheus_ scrape relabelings. | `[]` | +| `serviceMonitor.targetLabels` | _Prometheus_ scrape targetLabels. | `[]` | +| `env` | [Environment variables](https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/) for the _external-dns_ container, this supports the full [EnvVar](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#envvar-v1-core) API including secrets and configmaps. | `[]` | +| `livenessProbe` | [Liveness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) for the _external-dns_ container, this supports the full [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#probe-v1-core) API. | See _values.yaml_ | +| `readinessProbe` | [Readiness probe](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) for the _external-dns_ container, this supports the full [Probe](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#probe-v1-core) API. | See _values.yaml_ | +| `service.annotations` | Annotations to add to the service. | `{}` | +| `service.port` | Port to expose via the service. | `7979` | +| `extraVolumes` | Additional volumes for the pod, this supports the full [VolumeDevice](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#volumedevice-v1-core) API. | `[]` | +| `extraVolumeMounts` | Additional volume mounts for the _external-dns_ container, this supports the full [VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#volumemount-v1-core) API. | `[]` | +| `resources` | Resource requests and limits for the _external-dns_ container, this supports the full [ResourceRequirements](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#resourcerequirements-v1-core) API. | `{}` | +| `nodeSelector` | Node labels for pod assignment. | `{}` | +| `tolerations` | Tolerations for pod assignment, this supports the full [Toleration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#toleration-v1-core) API. | `[]` | +| `affinity` | Affinity settings for pod assignment, this supports the full [Affinity](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#affinity-v1-core) API. | `{}` | +| `topologySpreadConstraints` | TopologySpreadConstraint settings for pod assignment, this supports the full [TopologySpreadConstraints](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#topologyspreadconstraint-v1-core) API. | `[]` | +| `logLevel` | Verbosity of the logs, available values are: `panic`, `debug`, `info`, `warning`, `error`, `fatal`. | `info` | +| `logFormat` | Formats of the logs, available values are: `text`, `json`. | `text` | +| `interval` | The interval for DNS updates. | `1m` | +| `triggerLoopOnEvent` | When enabled, triggers run loop on create/update/delete events in addition of regular interval. | `false` | +| `namespaced` | When enabled, external-dns runs on namespace scope. Additionally, Role and Rolebinding will be namespaced, too. | `false` | +| `sources` | K8s resources type to be observed for new DNS entries. | See _values.yaml_ | +| `policy` | How DNS records are synchronized between sources and providers, available values are: `sync`, `upsert-only`. | `upsert-only` | +| `registry` | Registry Type, available types are: `txt`, `noop`. | `txt` | +| `txtOwnerId` | TXT registry identifier. | `""` | +| `txtPrefix` | Prefix to create a TXT record with a name following the pattern `prefix.`. | `""` | +| `domainFilters` | Limit possible target zones by domain suffixes. | `[]` | +| `provider` | DNS provider where the DNS records will be created, for the available providers and how to configure them see the [README](https://github.com/kubernetes-sigs/external-dns#deploying-to-a-cluster) (this can be templated). | `aws` | +| `extraArgs` | Extra arguments to pass to the _external-dns_ container, these are needed for provider specific arguments (these can be templated). | `[]` | +| `deploymentStrategy` | .spec.strategy of the external-dns Deployment. Defaults to 'Recreate' since multiple external-dns pods may conflict with each other. | `{type: Recreate}` | +| `secretConfiguration.enabled` | Enable additional secret configuration. | `false` | +| `secretConfiguration.mountPath` | Mount path of secret configuration secret (this can be templated). | `""` | +| `secretConfiguration.data` | Secret configuration secret data. Could be used to store DNS provider credentials. | `{}` | +| `secretConfiguration.subPath` | Sub-path of secret configuration secret (this can be templated). | `""` | +| `automountServiceAccountToken` | Opt out of the [service account token automounting feature](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) for the pod | _see values.yaml_ | ## Namespaced scoped installation diff --git a/charts/external-dns/templates/deployment.yaml b/charts/external-dns/templates/deployment.yaml index c05d50df42..0ae7f562c8 100644 --- a/charts/external-dns/templates/deployment.yaml +++ b/charts/external-dns/templates/deployment.yaml @@ -33,6 +33,9 @@ spec: {{- end }} {{- end }} spec: + {{- if hasKey .Values "automountServiceAccountToken" }} + automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} + {{- end }} {{- with .Values.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} diff --git a/charts/external-dns/templates/serviceaccount.yaml b/charts/external-dns/templates/serviceaccount.yaml index c071ab12ae..84aa8494b9 100644 --- a/charts/external-dns/templates/serviceaccount.yaml +++ b/charts/external-dns/templates/serviceaccount.yaml @@ -1,6 +1,9 @@ {{- if .Values.serviceAccount.create -}} apiVersion: v1 kind: ServiceAccount +{{- if hasKey .Values.serviceAccount "automountServiceAccountToken" }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end }} metadata: name: {{ include "external-dns.serviceAccountName" . }} namespace: {{ .Release.Namespace }} diff --git a/charts/external-dns/values.yaml b/charts/external-dns/values.yaml index fdcd421ac4..f17f4d7868 100644 --- a/charts/external-dns/values.yaml +++ b/charts/external-dns/values.yaml @@ -16,6 +16,9 @@ fullnameOverride: "" commonLabels: {} serviceAccount: + # opt out of the service account token automounting (at the service account level) + # automountServiceAccountToken: false + # Specifies whether a service account should be created create: true # Annotations to add to the service account @@ -193,3 +196,6 @@ secretConfiguration: deploymentStrategy: type: Recreate + +# opt out of the service account token automounting (at the pod level) +# automountServiceAccountToken: false