Merge pull request #444 from alecmerdler/PROJQUAY-1909

kustomize: use separate ServiceAccount for Quay app pods (PROJQUAY-1909)
quay · Apr 20, 2021 · 7f61ec9 · 7f61ec9
2 parents 007de38 + 51859ca
commit 7f61ec9
Show file tree

Hide file tree

Showing 6 changed files with 7 additions and 47 deletions.
diff --git a/kustomize/base/kustomization.yaml b/kustomize/base/kustomization.yaml
@@ -4,8 +4,7 @@ kind: Kustomization
 commonLabels:
   app: quay
 resources: 
-  - ./quay.role.yaml
-  - ./quay.rolebinding.yaml
+  - ./quay.serviceaccount.yaml
   - ./quay.deployment.yaml
   - ./quay.service.yaml
   - ./upgrade.deployment.yaml

diff --git a/kustomize/base/quay.deployment.yaml b/kustomize/base/quay.deployment.yaml
@@ -14,6 +14,7 @@ spec:
       labels:
         quay-component: quay-app
     spec:
+      serviceAccountName: quay-app
       volumes:
         - name: configvolume
           secret:

diff --git a/kustomize/base/quay.role.yaml b/kustomize/base/quay.role.yaml
diff --git a/kustomize/base/quay.rolebinding.yaml b/kustomize/base/quay.rolebinding.yaml
diff --git a/kustomize/base/quay.serviceaccount.yaml b/kustomize/base/quay.serviceaccount.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: quay-app
diff --git a/pkg/kustomize/kustomize_test.go b/pkg/kustomize/kustomize_test.go
@@ -11,7 +11,6 @@ import (
 	appsv1 "k8s.io/api/apps/v1"
 	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
-	rbac "k8s.io/api/rbac/v1beta1"
 	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -205,8 +204,6 @@ func TestFlattenSecret(t *testing.T) {
 
 var quayComponents = map[string][]client.Object{
 	"base": {
-		&rbac.Role{ObjectMeta: metav1.ObjectMeta{Name: "quay-serviceaccount"}},
-		&rbac.RoleBinding{ObjectMeta: metav1.ObjectMeta{Name: "quay-secret-writer"}},
 		&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "quay-app"}},
 		&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "quay-app-upgrade"}},
 		&appsv1.Deployment{ObjectMeta: metav1.ObjectMeta{Name: "quay-config-editor"}},
@@ -216,6 +213,7 @@ var quayComponents = map[string][]client.Object{
 		&corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: "cluster-service-ca"}},
 		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "quay-config-editor-credentials"}},
 		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "quay-registry-managed-secret-keys"}},
+		&corev1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "quay-app"}},
 	},
 	"clair": {
 		&corev1.Secret{ObjectMeta: metav1.ObjectMeta{Name: "clair-config-secret"}},