Readding ServiceAccount (#212)

* Readding ServiceAccount

* Bumping version

helm/taskchampion-sync-server/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: taskchampion-sync-server
 description: A Helm chart for deploying TaskChampion Sync Server on Kubernetes
 type: application
-version: 0.2.0
+version: 0.2.1
 appVersion: "0.7.0"
 keywords:
   - taskchampion

helm/taskchampion-sync-server/templates/_helpers.tpl

@@ -94,3 +94,7 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- define "taskchampion-sync-server.postgres-secret-name" -}}
 {{- printf "%s-connection" .Release.Name -}}
 {{- end -}}
+
+{{- define "taskchampion-sync-server.serviceAccountName" -}}
+{{- default (include "taskchampion-sync-server.fullname" .) .Values.serviceAccount.name -}}
+{{- end -}}

helm/taskchampion-sync-server/templates/deployment.yaml

@@ -23,6 +23,9 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ include "taskchampion-sync-server.serviceAccountName" . }}
+      {{- end }}
       securityContext:
         {{- toYaml .Values.securityContext | nindent 8 }}
       {{- if and .Values.postgres.enabled .Values.postgres.initContainer.enabled }}

helm/taskchampion-sync-server/templates/serviceaccount.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "taskchampion-sync-server.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "taskchampion-sync-server.labels" . | nindent 4 }}
+{{- end }}

helm/taskchampion-sync-server/values.yaml

@@ -96,6 +96,16 @@ replicas:
   enabled: false
   count: 1
 
+# ServiceAccount configuration
+# The app does not access the Kubernetes API, so no RBAC permissions are needed.
+# A dedicated ServiceAccount is created to give the pod a stable identity
+# for network policies, pod security, or future RBAC.
+serviceAccount:
+  # create specifies whether a ServiceAccount should be created
+  create: true
+  # name sets the ServiceAccount name
+  name: taskchampion-sync-server
+
 # Security context for the pod
 # NOTE: runAsUser and runAsGroup are intentionally unset.
 # The Docker entrypoint requires root to chown the data directory and then