mirrors/node-feature-discovery
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/node-feature-discovery.git synced 2024-12-14 11:57:51 +00:00
Code Activity

deployment/helm: user dedicated serviceaccount for topology-updater

Browse source 
Change the configuration so that, by default, we use a dedicated
serviceaccount for topology-updater (similar to topology-gc, nfd-master
and nfd-worker).

Fix the templates so that the serviceaccount and clusterrolebinding are
only created when topology-updater is enabled (clusterrole was already
handled this way).

This patch also correctly documents the default value of rbac.create
parameter of topology-updater and topology-gc.
This commit is contained in:
Markus Lehtonen 2023-05-05 08:24:42 +03:00 committed by k8s-infra-cherrypick-robot
parent a443406f4f
commit 408ab15e05
4 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
deployment/helm/node-feature-discovery/templates/clusterrolebinding.yaml
View file

@ -16,7 +16,7 @@ subjects:
{{- end }}
---
{{- if .Values.topologyUpdater.rbac.create }}
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.rbac.create }}
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:

2
deployment/helm/node-feature-discovery/templates/serviceaccount.yaml
View file

@ -13,7 +13,7 @@ metadata:
{{- end }}
---
{{- if .Values.topologyUpdater.serviceAccount.create }}
{{- if and .Values.topologyUpdater.enable .Values.topologyUpdater.serviceAccount.create }}
apiVersion: v1
kind: ServiceAccount
metadata:

2
deployment/helm/node-feature-discovery/values.yaml
View file

@ -398,7 +398,7 @@ topologyUpdater:
createCRDs: false
serviceAccount:
create: false
create: true
annotations: {}
name:
rbac:

4
docs/deployment/helm.md
View file

@ -162,7 +162,7 @@ We have introduced the following Chart parameters.
| `topologyUpdater.serviceAccount.create` | bool | true | Specifies whether the service account for topology updater should be created |
| `topologyUpdater.serviceAccount.annotations` | dict | {} | Annotations to add to the service account for topology updater |
| `topologyUpdater.serviceAccount.name` | string | | The name of the service account for topology updater to use. If not set and create is true, a name is generated using the fullname template and `-topology-updater` suffix |
| `topologyUpdater.rbac.create` | bool | false | Specifies whether to create [RBAC][rbac] configuration for topology updater |
| `topologyUpdater.rbac.create` | bool | true | Specifies whether to create [RBAC][rbac] configuration for topology updater |
| `topologyUpdater.kubeletConfigPath` | string | "" | Specifies the kubelet config host path |
| `topologyUpdater.kubeletPodResourcesSockPath` | string | "" | Specifies the kubelet sock path to read pod resources |
| `topologyUpdater.updateInterval` | string | 60s | Time to sleep between CR updates. Non-positive value implies no CR update. |
@ -187,7 +187,7 @@ We have introduced the following Chart parameters.
| `topologyGC.serviceAccount.create` | bool | true | Specifies whether the service account for topology garbage collector should be created |
| `topologyGC.serviceAccount.annotations` | dict | {} | Annotations to add to the service account for topology garbage collector |
| `topologyGC.serviceAccount.name` | string | | The name of the service account for topology garbage collector to use. If not set and create is true, a name is generated using the fullname template and `-topology-gc` suffix |
| `topologyGC.rbac.create` | bool | false | Specifies whether to create [RBAC][rbac] configuration for topology garbage collector |
| `topologyGC.rbac.create` | bool | true | Specifies whether to create [RBAC][rbac] configuration for topology garbage collector |
| `topologyGC.interval` | string | 1h | Time between periodic garbage collector runs |
| `topologyGC.podSecurityContext` | dict | {} | [PodSecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod) holds pod-level security attributes and common container settings |
| `topologyGC.securityContext` | dict | {} | Container [security settings](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container) |