Skip to content

✨ feat: (helm/v1alpha1): Allow ServiceAccount annotations to be configurable #4380

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 24, 2024
Merged

✨ feat: (helm/v1alpha1): Allow ServiceAccount annotations to be configurable #4380

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions pkg/plugins/optional/helm/v1alpha/scaffolds/init.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,6 +292,19 @@ func copyFileWithHelmLogic(srcFile, destFile, subDir, projectName string) error
contentStr = strings.Replace(contentStr,
"name: metrics-reader",
fmt.Sprintf("name: %s-metrics-reader", projectName), 1)
if strings.Contains(contentStr, "-controller-manager") &&
strings.Contains(contentStr, "kind: ServiceAccount") &&
!strings.Contains(contentStr, "RoleBinding") {
// The generated Service Account does not have the annotations field so we must add it.
contentStr = strings.Replace(contentStr,
"metadata:", `metadata:
{{- if and .Values.controllerManager.serviceAccount .Values.controllerManager.serviceAccount.annotations }}
annotations:
{{- range $key, $value := .Values.controllerManager.serviceAccount.annotations }}
{{ $key }}: {{ $value }}
{{- end }}
{{- end }}`, 1)
Copy link
Member

@camilamacedo86 camilamacedo86 Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I fear we give too many options to custom things that do not exist in the project itself. The chart is only a way to package the staff. It should work the same way.

So, I will need to think about it a little

Copy link
Contributor Author

@monteiro-renato monteiro-renato Nov 22, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This, I guess?
I don't think I fully understand what is meant by "The proposed solution may not be capable of generating a fully valid and deployable Helm Chart for all use cases supported by Kubebuilder.". Is there a good resource for me to read on the supported Kubebuilder use cases?

For my team's use case we need to simplify Azure resources management and therefore need to talk to Azure APIs. To talk to the Azure APIs we need valid credentials. The best practice right now is to use Workload Identity. Configuring a k8s workload to use Workload Identity requires a few annotations and labels in some resources (such as a label in the pod spec and an annotation in the k8s service account).

I was able to do these configurations by using Kustomize patches, however, with our current setup, it's easier to deploy via Helm than it is to deploy k8s manifests so I wanted to test how I could achieve a similar goal with Helm.

Copy link
Member

@camilamacedo86 camilamacedo86 Nov 24, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I checked this again, and I think it looks fine. We are getting the annotations from Kustomize and applying them here, which aligns with the intended design.

What I am concerned about is the potential risk of introducing customizations that are only valid for the Helm Chart.

"The proposed solution may not be capable of generating a fully valid and deployable Helm Chart for all use cases supported by Kubebuilder."

In this case, we will take a best-effort approach. This is an initial version, so it's expected that we may encounter scenarios that are challenging to support.

We must avoid, however, allowing customizations that deviate from the chart's intended purpose. The Helm Chart is meant to package and deploy the solution, not to create a new variant of it.

I hope that makes sense.
Please feel free to speak with us on the Slack channel as well.

Copy link
Member

@camilamacedo86 camilamacedo86 Nov 24, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@monteiro-renato
Could we add annotations for ALL manifests instead of only these?
Would not that make more sense?
I mean, should it not be a generic option?
Why the case scenario is valid only for service account

Copy link
Contributor Author

@monteiro-renato monteiro-renato Nov 24, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@camilamacedo86, I don't think that's ideal.

From the docs: "You can use Kubernetes annotations to attach arbitrary non-identifying metadata to objects. Clients such as tools and libraries can retrieve this metadata."
In the example use case I mentioned above, Azure uses the annotations in the Service Account to: "... configure the behavior when exchanging the service account token for an AAD access token:" The annotations would therefore only make sense in the context of a Service Account.

Just like particular labels only make sense in the context of particular objects: ref my other PR > #4373

Copy link
Member

@camilamacedo86 camilamacedo86 Nov 24, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we can add annotations in the resources, but it is not ONLY valid for ServiceAccount.
Did you check if it has other places that we need to do something ?
That is my point.

Copy link
Contributor Author

@monteiro-renato monteiro-renato Nov 24, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see, I thought you were talking about applying the same annotation to all resources.

I believe it's best to add those features if/when they are needed (i.e. if someone has the need for it, they can open a PR to add that feature just like I'm doing here).

P.S: I plan to join the Slack channel eventually, which will make discussing these things a bit easier.

}
contentStr = strings.Replace(contentStr,
"name: leader-election-role",
fmt.Sprintf("name: %s-leader-election-role", projectName), -1)
Expand Down
6 changes: 6 additions & 0 deletions testdata/project-v4-with-plugins/dist/chart/templates/rbac/service_account.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,12 @@ kind: ServiceAccount
metadata:
labels:
{{- include "chart.labels" . | nindent 4 }}
{{- if and .Values.controllerManager.serviceAccount .Values.controllerManager.serviceAccount.annotations }}
annotations:
{{- range $key, $value := .Values.controllerManager.serviceAccount.annotations }}
{{ $key }}: {{ $value }}
{{- end }}
{{- end }}
name: project-v4-with-plugins-controller-manager
namespace: {{ .Release.Namespace }}
{{- end -}}
Loading