mirror of
https://github.com/truenas/charts.git
synced 2026-04-13 17:52:13 +08:00
929e60d801
* Adapt charts CI and improve/fix common * add check on permissions contaienr * add postgres template * update comments * Update create_app.sh * add check * update script * auto gen item.yaml from Chart,yaml * rename readme on dest * duplicate readme from the same source * correct comment * reoder * remove extra space * keep both README and app-readme * update regex, to also allow 2 letter names, which is also valid * No need to check host network if there aren't any pod values * use same pattern as the pod.name label (not prepending release-name * update deps * add chart dirs to ci * Add a validation to check if there is any yaml errors after merging files * update charts path on ci * common/1.0.0/ -> common/ * update common-test dep path * temp update create_app script * make permissions container name configurable, incase we want to change order of execution * update naming convention * fix typo and a missed name change * do not allow `--` in names
53 lines
2.0 KiB
Smarty
53 lines
2.0 KiB
Smarty
{{/* Returns Service Account List for rbac */}}
|
|
{{/* Call this template:
|
|
{{ include "ix.v1.common.lib.rbac.serviceAccount" (dict "rootCtx" $ "objectData" $objectData) }}
|
|
rootCtx: The root context of the chart.
|
|
objectData: The object data to be used to render the RBAC.
|
|
*/}}
|
|
{{/* Parses service accounts, and checks if RBAC have selected any of them */}}
|
|
{{- define "ix.v1.common.lib.rbac.serviceAccount" -}}
|
|
{{- $rootCtx := .rootCtx -}}
|
|
{{- $objectData := .objectData -}}
|
|
|
|
{{- $serviceAccounts := list -}}
|
|
|
|
{{- range $name, $serviceAccount := $rootCtx.Values.serviceAccount -}}
|
|
{{- $saName := include "ix.v1.common.lib.chart.names.fullname" $rootCtx -}}
|
|
|
|
{{- if $serviceAccount.enabled -}}
|
|
|
|
{{- if not $serviceAccount.primary -}}
|
|
{{- $saName = (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $rootCtx) $name) -}}
|
|
{{- end -}}
|
|
|
|
{{/* If allServiceAccounts is true */}}
|
|
{{- if $objectData.allServiceAccounts -}}
|
|
{{- $serviceAccounts = mustAppend $serviceAccounts $saName -}}
|
|
|
|
{{/* Else if serviceAccounts is a list */}}
|
|
{{- else if (kindIs "slice" $objectData.serviceAccounts) -}}
|
|
{{- if (mustHas $name $objectData.serviceAccounts) -}}
|
|
{{- $serviceAccounts = mustAppend $serviceAccounts $saName -}}
|
|
{{- end -}}
|
|
|
|
{{/* If not "allServiceAccounts" or "serviceAccounts", assign the primary service account to rbac */}}
|
|
{{- else if $serviceAccount.primary -}}
|
|
{{- if $objectData.primary -}}
|
|
{{- $serviceAccounts = mustAppend $serviceAccounts $saName -}}
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{- end -}}
|
|
{{- end -}}
|
|
|
|
{{- if not $serviceAccounts -}}
|
|
{{- fail "RBAC - Expected at least one serviceAccount to be assigned. Assign one using [allServiceAccounts (boolean), serviceAccounts (list)]" -}}
|
|
{{- end -}}
|
|
|
|
{{- range $serviceAccounts }}
|
|
- kind: ServiceAccount
|
|
name: {{ . }}
|
|
namespace: {{ $rootCtx.Release.Namespace }}
|
|
{{- end -}}
|
|
{{- end -}}
|