feat(helm/provisioner): support deploying multiple provisioners in same namespace#15637
Conversation
| # coder.serviceAccount.name -- The service account name | ||
| name: coder | ||
| # coder.serviceAccount.name -- Whether to create the service account or use existing service account | ||
| # coder.serviceAccount.disableCreate -- Whether to create the service account or use existing service account. |
There was a problem hiding this comment.
self review: drive-by typo fix
| pskSecretName: "coder-provisioner-psk" | ||
| keySecretName: "coder-provisionerd-key" | ||
| keySecretKey: "provisionerd-key" |
There was a problem hiding this comment.
self-review: advertising provisioner keys as the preferred auth method
| extraTemplates: | ||
| - | | ||
| apiVersion: v1 | ||
| kind: ConfigMap | ||
| metadata: | ||
| name: some-other-config | ||
| namespace: {{ .Release.Namespace }} | ||
| data: | ||
| key: some-other-value |
There was a problem hiding this comment.
self-review: this isn't strictly necessary, but I figured it could be a potential point of confusion, so elected to clarify it here.
| keySecretKey: "provisionerd-key" | ||
| ``` | ||
|
|
||
| ## Specific Examples |
There was a problem hiding this comment.
self-review: these examples are essentially lifted from our tests
| name: other-coder-provisioner | ||
| provisionerDaemon: | ||
| # ... | ||
| nameOverride: "other-coder-provisioner" |
There was a problem hiding this comment.
self-review: this setting is essentially buried in libcoder, but it seems to be the best way to do this. Introducing a new separate variable here is just going to make things more complicated.
| {{- if not .Values.coder.serviceAccount.disableCreate }} | ||
| {{ include "libcoder.serviceaccount" (list . "coder.serviceaccount") }} | ||
| {{- end }} |
There was a problem hiding this comment.
self-review: this was added for helm/coder in #14817 but not ported over here.
I'm not sure if it would be better to do it in libcoder, folks don't seem to look in there much.
| type: RuntimeDefault | ||
| volumeMounts: [] | ||
| restartPolicy: Always | ||
| serviceAccountName: other-coder-provisioner |
There was a problem hiding this comment.
self-review: the fact that nameOverride has no bearing on serviceAccountName explicitly allows us to reference a pre-existing service account
ethanndickson
left a comment
There was a problem hiding this comment.
LGTM, but will let someone with more helm experience approve
Fixes #15437
coder.serviceAccount.disableCreate(originally added tohelm/coderin feat(helm): add setting to disable service account creation #14817).helm/provisioner/README.mdon deploying multiple provisioners in the same namespace leveragingnameOverride.This allows us to support the following use-cases:
nameOverrideandcoder.serviceAccount.Namecoder.serviceAccount.disableCreate=true,coder.serviceAccount.workspacePerms=falseandcoder.serviceAccount.name=<name of existing sa>.Validated
nameOverrideusing kustomize: