feat: Added Ingress SecurityContext and ServiceAccount

templates/_utils.tpl

@@ -81,3 +81,24 @@ helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | quote }}
 {{ include "opal.pgsqlSelectorLabels" . }}
 {{- end -}}
 
+{{/*
+Create the name of the server service account to use
+*/}}
+{{- define "opal.serverServiceAccountName" -}}
+{{- if .Values.server.serviceAccount.create }}
+{{- default (include "opal.serverName" .) .Values.server.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.server.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the client service account to use
+*/}}
+{{- define "opal.clientServiceAccountName" -}}
+{{- if .Values.client.serviceAccount.create }}
+{{- default (include "opal.clientName" .) .Values.client.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.client.serviceAccount.name }}
+{{- end }}
+{{- end }}

templates/deployment-client.yaml

@@ -21,6 +21,11 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      serviceAccountName: {{ include "opal.clientServiceAccountName" . }}
+      {{- with .Values.client.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.client.opaStartupData }}
       volumes:
         - name: opa-startup-data
@@ -30,6 +35,10 @@ spec:
       {{- end }}
       containers:
         - name: opal-client
+          {{- with .Values.client.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           image: {{ include "opal.clientImage" . | quote }}
           imagePullPolicy: {{ .Values.client.imagePullPolicy | default "IfNotPresent" | quote }}
           ports:

templates/deployment-pgsql.yaml

@@ -20,10 +20,18 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.pgsql.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: pgsql
           image: {{ include "opal.pgsqlImage" . | quote }}
           imagePullPolicy: IfNotPresent
+          {{- with .Values.pgsql.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - name: pgsql
               containerPort: 5432

templates/deployment-server.yaml

@@ -21,6 +21,11 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      serviceAccountName: {{ include "opal.serverServiceAccountName" . }}
+      {{- with .Values.server.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       {{- if .Values.e2e }}
       volumes:
         - name: e2e
@@ -34,6 +39,10 @@ spec:
         - name: git-init
           image: {{ include "opal.serverImage" . | quote }}
           imagePullPolicy: IfNotPresent
+          {{- with .Values.server.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           volumeMounts:
             - mountPath: /opt/e2e
               name: e2e
@@ -63,6 +72,10 @@ spec:
         - name: opal-server
           image: {{ include "opal.serverImage" . | quote }}
           imagePullPolicy: {{ .Values.server.imagePullPolicy | default "IfNotPresent" | quote }}
+          {{- with .Values.server.securityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           {{- if .Values.e2e }}
           volumeMounts:
             - mountPath: /opt/e2e/policy-repo-data

templates/ingress-client.yaml

@@ -0,0 +1,43 @@
+{{- if .Values.client.ingress.enabled -}}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: {{ include "opal.clientName" . }}
+  labels:
+    {{- include "opal.clientLabels" . | nindent 4 }}
+  {{- with .Values.client.ingress.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+spec:
+  {{- with .Values.client.ingress.className }}
+  ingressClassName: {{ . }}
+  {{- end }}
+  {{- if .Values.client.ingress.tls }}
+  tls:
+    {{- range .Values.client.ingress.tls }}
+    - hosts:
+        {{- range .hosts }}
+        - {{ . | quote }}
+        {{- end }}
+      secretName: {{ .secretName }}
+    {{- end }}
+  {{- end }}
+  rules:
+    {{- range .Values.client.ingress.hosts }}
+    - host: {{ .host | quote }}
+      http:
+        paths:
+          {{- range .paths }}
+          - path: {{ .path }}
+            {{- with .pathType }}
+            pathType: {{ . }}
+            {{- end }}
+            backend:
+              service:
+                name: {{ include "opal.clientName" $ }}
+                port:
+                  number: {{ .port }}
+          {{- end }}
+    {{- end }}
+{{- end }}

templates/serviceaccount-client.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.client.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "opal.clientServiceAccountName" . }}
+  labels:
+    {{- include "opal.clientLabels" . | nindent 4 }}
+  {{- with .Values.client.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.client.serviceAccount.automount }}
+{{- end }}

templates/serviceaccount-server.yaml

@@ -0,0 +1,13 @@
+{{- if .Values.server.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "opal.serverServiceAccountName" . }}
+  labels:
+    {{- include "opal.serverLabels" . | nindent 4 }}
+  {{- with .Values.server.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.server.serviceAccount.automount }}
+{{- end }}