From 794718d5a1ee527356bd2d97196f0ce962f92533 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20G=C3=B3recki?= Date: Wed, 19 Aug 2026 04:29:13 +0200 Subject: [PATCH 1/3] Run workloads under dedicated ServiceAccounts without API tokens All workload pods previously ran under the namespace default ServiceAccount with its API token mounted, although none of them talk to the Kubernetes API. Each chart now creates its own ServiceAccount (shopsys-app / shopsys-infra) with automountServiceAccountToken: false, assigned centrally through the shared podSettings helper. Hook Jobs: cron-suspend keeps the deploy-hooks SA (it needs the API); the migration and post-deploy Jobs stay on the default SA - a pre-install hook cannot reference the chart SA, which does not exist yet on first deploy - but opt out of the token mount at the pod level. Co-Authored-By: Claude Fable 5 --- .../hooks/job-migrate-application.yaml | 4 + .../templates/hooks/job-post-deploy.yaml | 3 + .../shopsys-app/templates/serviceaccount.yaml | 9 +++ .../tests/serviceaccount_test.yaml | 73 +++++++++++++++++++ charts/shopsys-app/values.yaml | 10 +++ charts/shopsys-common/templates/_helpers.tpl | 12 +++ .../templates/serviceaccount.yaml | 9 +++ charts/shopsys-infra/tests/infra_test.yaml | 18 +++++ charts/shopsys-infra/values.yaml | 7 ++ docs/migrating-from-shopsys-deployment.md | 8 ++ docs/values.md | 6 ++ .../basic-production/expected/continuous.yaml | 45 ++++++++++-- .../expected/first-deploy-with-demo-data.yaml | 45 ++++++++++-- .../expected/first-deploy.yaml | 45 ++++++++++-- .../expected/continuous.yaml | 43 +++++++++-- .../expected/first-deploy-with-demo-data.yaml | 43 +++++++++-- .../expected/first-deploy.yaml | 43 +++++++++-- .../expected/continuous.yaml | 43 +++++++++-- .../expected/first-deploy-with-demo-data.yaml | 43 +++++++++-- .../expected/first-deploy.yaml | 43 +++++++++-- .../escaping-env/expected/continuous.yaml | 45 ++++++++++-- .../expected/first-deploy-with-demo-data.yaml | 45 ++++++++++-- .../escaping-env/expected/first-deploy.yaml | 45 ++++++++++-- .../expected/continuous.yaml | 47 ++++++++++-- .../expected/first-deploy-with-demo-data.yaml | 47 ++++++++++-- .../expected/first-deploy.yaml | 47 ++++++++++-- 26 files changed, 741 insertions(+), 87 deletions(-) create mode 100644 charts/shopsys-app/templates/serviceaccount.yaml create mode 100644 charts/shopsys-app/tests/serviceaccount_test.yaml create mode 100644 charts/shopsys-infra/templates/serviceaccount.yaml diff --git a/charts/shopsys-app/templates/hooks/job-migrate-application.yaml b/charts/shopsys-app/templates/hooks/job-migrate-application.yaml index 08db7d3..92da3fb 100644 --- a/charts/shopsys-app/templates/hooks/job-migrate-application.yaml +++ b/charts/shopsys-app/templates/hooks/job-migrate-application.yaml @@ -37,6 +37,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/charts/shopsys-app/templates/hooks/job-post-deploy.yaml b/charts/shopsys-app/templates/hooks/job-post-deploy.yaml index bfa5c40..486bd71 100644 --- a/charts/shopsys-app/templates/hooks/job-post-deploy.yaml +++ b/charts/shopsys-app/templates/hooks/job-post-deploy.yaml @@ -19,6 +19,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/charts/shopsys-app/templates/serviceaccount.yaml b/charts/shopsys-app/templates/serviceaccount.yaml new file mode 100644 index 0000000..12d8dc6 --- /dev/null +++ b/charts/shopsys-app/templates/serviceaccount.yaml @@ -0,0 +1,9 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shopsys.serviceAccountName" . }} + labels: + {{- include "shopsys.labels" $ | nindent 4 }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }} +{{- end }} diff --git a/charts/shopsys-app/tests/serviceaccount_test.yaml b/charts/shopsys-app/tests/serviceaccount_test.yaml new file mode 100644 index 0000000..66cb319 --- /dev/null +++ b/charts/shopsys-app/tests/serviceaccount_test.yaml @@ -0,0 +1,73 @@ +suite: dedicated service account +values: + - ./values/required.yaml +templates: + - templates/serviceaccount.yaml + - templates/deployment-webserver-php-fpm.yaml + - templates/hooks/job-migrate-application.yaml +tests: + - it: creates the chart ServiceAccount without token automount + template: templates/serviceaccount.yaml + asserts: + - equal: + path: metadata.name + value: shopsys-app + - equal: + path: automountServiceAccountToken + value: false + + - it: assigns the ServiceAccount to workload pods + template: templates/deployment-webserver-php-fpm.yaml + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: shopsys-app + + - it: honors a custom name + template: templates/serviceaccount.yaml + set: + serviceAccount: + name: my-account + asserts: + - equal: + path: metadata.name + value: my-account + + - it: references an externally managed account when create is false + template: templates/deployment-webserver-php-fpm.yaml + set: + serviceAccount: + create: false + name: external-account + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: external-account + + - it: renders no ServiceAccount when create is false + template: templates/serviceaccount.yaml + set: + serviceAccount: + create: false + asserts: + - hasDocuments: + count: 0 + + - it: falls back to the default SA when create is false and no name is given + template: templates/deployment-webserver-php-fpm.yaml + set: + serviceAccount: + create: false + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: default + + - it: does not mount the default SA token into the migration hook + template: templates/hooks/job-migrate-application.yaml + asserts: + - equal: + path: spec.template.spec.automountServiceAccountToken + value: false + - notExists: + path: spec.template.spec.serviceAccountName diff --git a/charts/shopsys-app/values.yaml b/charts/shopsys-app/values.yaml index d14696a..ede0151 100644 --- a/charts/shopsys-app/values.yaml +++ b/charts/shopsys-app/values.yaml @@ -65,6 +65,16 @@ registry: imagePullSecrets: - dockerregistry +# ServiceAccount the workload pods run under (the hook Jobs keep the deploy-hooks SA). +# None of the workloads talk to the Kubernetes API, so the token is not mounted. +# NOTE: the helmfile passes these values to both charts - leave `name` empty (each chart +# defaults to its own chart name) or set create=false with an externally managed account; +# an explicit name with create=true would make both releases fight over one ServiceAccount. +serviceAccount: + create: true + name: "" # generated from the chart name when empty + automountToken: false + app: # Backend environment variables (webserver, cron, consumers, migration job, cron shell). # Values MUST be strings - quote values like "479411e7" in YAML. diff --git a/charts/shopsys-common/templates/_helpers.tpl b/charts/shopsys-common/templates/_helpers.tpl index db214de..db82335 100644 --- a/charts/shopsys-common/templates/_helpers.tpl +++ b/charts/shopsys-common/templates/_helpers.tpl @@ -248,10 +248,22 @@ checksum/php-fpm: {{ printf "%s%s" ($root.Values.webserver.phpFpm.config | defau {{- end }} {{- end }} +{{/* Name of the chart-scoped ServiceAccount workload pods run under. + Defaults to the chart name; with create=false an explicitly named (externally + managed) ServiceAccount is referenced, falling back to "default". */}} +{{- define "shopsys.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} +{{- .Values.serviceAccount.name | default .Chart.Name -}} +{{- else -}} +{{- .Values.serviceAccount.name | default "default" -}} +{{- end -}} +{{- end }} + {{/* Standard scheduling/security pod fields shared by every component. ctx: (dict "root" $ "component" ) Rendered at zero indent — use `| nindent N` at the call site. */}} {{- define "shopsys.podSettings" -}} +serviceAccountName: {{ include "shopsys.serviceAccountName" .root }} {{- with .component.nodeSelector }} nodeSelector: {{ toYaml . | indent 2 }} diff --git a/charts/shopsys-infra/templates/serviceaccount.yaml b/charts/shopsys-infra/templates/serviceaccount.yaml new file mode 100644 index 0000000..12d8dc6 --- /dev/null +++ b/charts/shopsys-infra/templates/serviceaccount.yaml @@ -0,0 +1,9 @@ +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "shopsys.serviceAccountName" . }} + labels: + {{- include "shopsys.labels" $ | nindent 4 }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }} +{{- end }} diff --git a/charts/shopsys-infra/tests/infra_test.yaml b/charts/shopsys-infra/tests/infra_test.yaml index b8b6df2..025d3f3 100644 --- a/charts/shopsys-infra/tests/infra_test.yaml +++ b/charts/shopsys-infra/tests/infra_test.yaml @@ -7,6 +7,7 @@ templates: - templates/ingress-rabbitmq.yaml - templates/rbac-deploy-hooks.yaml - templates/secret-rabbitmq.yaml + - templates/serviceaccount.yaml tests: - it: runs redis as the first container with the exporter sidecar and health probes template: templates/deployment-redis.yaml @@ -92,3 +93,20 @@ tests: - equal: path: stringData.password value: secret + + - it: runs infra pods under the chart ServiceAccount without token automount + template: templates/serviceaccount.yaml + asserts: + - equal: + path: metadata.name + value: shopsys-infra + - equal: + path: automountServiceAccountToken + value: false + + - it: assigns the ServiceAccount to the rabbitmq pod + template: templates/statefulset-rabbitmq.yaml + asserts: + - equal: + path: spec.template.spec.serviceAccountName + value: shopsys-infra diff --git a/charts/shopsys-infra/values.yaml b/charts/shopsys-infra/values.yaml index 3c7c46c..33aa891 100644 --- a/charts/shopsys-infra/values.yaml +++ b/charts/shopsys-infra/values.yaml @@ -31,6 +31,13 @@ registry: # when set, pods reference this name instead of "dockerregistry". existingSecret: "" +# ServiceAccount the redis/rabbitmq pods run under; see the app chart for the shared-values +# caveat (leave `name` empty - it defaults to the chart name per chart). +serviceAccount: + create: true + name: "" + automountToken: false + redis: enabled: true image: diff --git a/docs/migrating-from-shopsys-deployment.md b/docs/migrating-from-shopsys-deployment.md index 1fa08f6..2c865aa 100644 --- a/docs/migrating-from-shopsys-deployment.md +++ b/docs/migrating-from-shopsys-deployment.md @@ -136,3 +136,11 @@ Intentional differences of the phase-1 rewrite; everything else is a 1:1 port. via `webserver.pdb.enabled` / `storefront.pdb.enabled`. `topologySpreadConstraints` is also available as a standard component key (empty by default — the legacy anti-affinity defaults are kept untouched). +23. **Dedicated ServiceAccounts**: workload pods previously ran under the namespace + `default` ServiceAccount with its API token mounted. Each chart now creates its own + ServiceAccount (`shopsys-app` / `shopsys-infra`) with + `automountServiceAccountToken: false` — none of the workloads talk to the Kubernetes + API. The hook Jobs are unchanged: `cron-suspend` keeps the `deploy-hooks` SA (needs the + API), and the migration/post-deploy Jobs stay on the default SA (a `pre-install` hook + cannot reference the chart SA, which does not exist yet) but no longer mount its token. + Configure via `serviceAccount: {create, name, automountToken}`. diff --git a/docs/values.md b/docs/values.md index 0c4c05b..395af7b 100644 --- a/docs/values.md +++ b/docs/values.md @@ -65,6 +65,12 @@ security: registry: # image pull secret; credentials sensitive → env vars existingSecret: "" # OR reference an externally managed pull secret +serviceAccount: # per-chart SA the workload pods run under (no API token mounted) + create: true + name: "" # empty = chart name per chart; leave empty (shared values - + # an explicit name would collide between the two releases) + automountToken: false + app: # shared backend configuration env: {} # non-sensitive backend env vars (webserver, cron, consumers, migration) secretEnv: {} # sensitive backend env vars → app-secret-env Secret + envFrom; diff --git a/tests/golden/scenarios/basic-production/expected/continuous.yaml b/tests/golden/scenarios/basic-production/expected/continuous.yaml index c9e0883..29b21ce 100644 --- a/tests/golden/scenarios/basic-production/expected/continuous.yaml +++ b/tests/golden/scenarios/basic-production/expected/continuous.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1109,7 +1135,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1245,7 +1271,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1345,7 +1371,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1792,6 +1818,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1860,6 +1890,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml index 496ab61..ca29d9d 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1109,7 +1135,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1245,7 +1271,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1345,7 +1371,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1792,6 +1818,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1860,6 +1890,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml index 604024c..32b5a51 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1109,7 +1135,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1245,7 +1271,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1345,7 +1371,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1792,6 +1818,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1860,6 +1890,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml index 28d68ed..83fed89 100644 --- a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1107,7 +1133,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1203,7 +1229,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1563,6 +1589,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1631,6 +1661,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml index dd03f83..866b5b8 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1107,7 +1133,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1203,7 +1229,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1563,6 +1589,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1631,6 +1661,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml index b47ecba..9fd787a 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1107,7 +1133,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1203,7 +1229,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1563,6 +1589,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1631,6 +1661,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml index 614b733..4344462 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1107,7 +1133,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1203,7 +1229,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1617,6 +1643,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1685,6 +1715,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml index 6b5df52..5a5c3dc 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1107,7 +1133,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1203,7 +1229,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1617,6 +1643,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1685,6 +1715,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml index 07583c9..ba5bae6 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -971,7 +997,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1107,7 +1133,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1203,7 +1229,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1617,6 +1643,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1685,6 +1715,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/escaping-env/expected/continuous.yaml b/tests/golden/scenarios/escaping-env/expected/continuous.yaml index 2bf2fbe..1a7c36d 100644 --- a/tests/golden/scenarios/escaping-env/expected/continuous.yaml +++ b/tests/golden/scenarios/escaping-env/expected/continuous.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -987,7 +1013,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1127,7 +1153,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1266,7 +1292,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1371,7 +1397,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1819,6 +1845,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1889,6 +1919,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml index 46d8f35..d9dffea 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -987,7 +1013,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1127,7 +1153,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1266,7 +1292,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1371,7 +1397,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1819,6 +1845,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1889,6 +1919,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml index 0a3d09f..140298f 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -987,7 +1013,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1127,7 +1153,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1266,7 +1292,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1371,7 +1397,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1819,6 +1845,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1889,6 +1919,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml index 3757348..573665b 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -972,7 +998,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1108,7 +1134,7 @@ spec: labels: app: consumer-order spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1246,7 +1272,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1382,7 +1408,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1482,7 +1508,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1930,6 +1956,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1998,6 +2028,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml index b3bfe0e..bb58251 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -972,7 +998,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1108,7 +1134,7 @@ spec: labels: app: consumer-order spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1246,7 +1272,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1382,7 +1408,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1482,7 +1508,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1930,6 +1956,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1998,6 +2028,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml index dd354a2..de066aa 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml @@ -12,6 +12,19 @@ metadata: app.kubernetes.io/managed-by: Helm helm.sh/chart: shopsys-infra-1.0.0 +--- +# Source: shopsys-infra/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-infra + labels: + app.kubernetes.io/name: shopsys-infra + app.kubernetes.io/instance: shopsys-infra + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-infra-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-infra/templates/secret-rabbitmq.yaml apiVersion: v1 @@ -201,7 +214,7 @@ spec: labels: app: redis spec: - + serviceAccountName: shopsys-infra volumes: - name: health configMap: @@ -284,7 +297,7 @@ spec: labels: app: rabbitmq spec: - + serviceAccountName: shopsys-infra affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -408,6 +421,19 @@ spec: matchLabels: app: webserver-php-fpm +--- +# Source: shopsys-app/templates/serviceaccount.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: shopsys-app + labels: + app.kubernetes.io/name: shopsys-app + app.kubernetes.io/instance: shopsys-app + app.kubernetes.io/managed-by: Helm + helm.sh/chart: shopsys-app-1.0.0 +automountServiceAccountToken: false + --- # Source: shopsys-app/templates/secret-app-env.yaml apiVersion: v1 @@ -972,7 +998,7 @@ spec: labels: app: consumer-email spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1108,7 +1134,7 @@ spec: labels: app: consumer-order spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1246,7 +1272,7 @@ spec: # Forces a fresh cron pod on every deploy (legacy `date` label) date: "1234567890" spec: - + serviceAccountName: shopsys-app tolerations: - effect: NoSchedule key: workload @@ -1382,7 +1408,7 @@ spec: labels: app: storefront spec: - + serviceAccountName: shopsys-app affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1482,7 +1508,7 @@ spec: labels: app: webserver-php-fpm spec: - + serviceAccountName: shopsys-app affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1930,6 +1956,10 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (as a pre-install hook it cannot reference the + # chart ServiceAccount, which does not exist yet); it never talks to the API, so the + # token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: @@ -1998,6 +2028,9 @@ spec: backoffLimit: 0 template: spec: + # Runs under the namespace default SA (kept consistent with the migration hook); + # it never talks to the API, so the token is not mounted. + automountServiceAccountToken: false volumes: - name: domains-urls configMap: From ccedfde4e506b29b2f441313cbf8f2fc4d7380c6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20G=C3=B3recki?= Date: Thu, 20 Aug 2026 12:20:46 +0200 Subject: [PATCH 2/3] Emit pod-level automountServiceAccountToken from podSettings Review follow-up: the no-token guarantee previously lived only on the chart-created ServiceAccount object, so serviceAccount.create=false with an external SA - or the silent fallback to the namespace default SA when name is left empty - could quietly reintroduce a mounted API token. Emitting automountToken at pod level (pod-level overrides SA-level) makes the guarantee independent of SA configuration; a user who genuinely needs the token can still set serviceAccount.automountToken=true. Docs now also spell out the default-SA fallback and the new semantics. Co-Authored-By: Claude Fable 5 --- .../shopsys-app/tests/serviceaccount_test.yaml | 17 +++++++++++++++++ charts/shopsys-app/values.yaml | 5 ++++- charts/shopsys-common/templates/_helpers.tpl | 1 + charts/shopsys-infra/tests/infra_test.yaml | 3 +++ charts/shopsys-infra/values.yaml | 3 ++- docs/migrating-from-shopsys-deployment.md | 4 +++- docs/values.md | 6 ++++-- .../basic-production/expected/continuous.yaml | 6 ++++++ .../expected/first-deploy-with-demo-data.yaml | 6 ++++++ .../basic-production/expected/first-deploy.yaml | 6 ++++++ .../expected/continuous.yaml | 5 +++++ .../expected/first-deploy-with-demo-data.yaml | 5 +++++ .../expected/first-deploy.yaml | 5 +++++ .../expected/continuous.yaml | 5 +++++ .../expected/first-deploy-with-demo-data.yaml | 5 +++++ .../expected/first-deploy.yaml | 5 +++++ .../escaping-env/expected/continuous.yaml | 6 ++++++ .../expected/first-deploy-with-demo-data.yaml | 6 ++++++ .../escaping-env/expected/first-deploy.yaml | 6 ++++++ .../expected/continuous.yaml | 7 +++++++ .../expected/first-deploy-with-demo-data.yaml | 7 +++++++ .../expected/first-deploy.yaml | 7 +++++++ 22 files changed, 121 insertions(+), 5 deletions(-) diff --git a/charts/shopsys-app/tests/serviceaccount_test.yaml b/charts/shopsys-app/tests/serviceaccount_test.yaml index 66cb319..34edd71 100644 --- a/charts/shopsys-app/tests/serviceaccount_test.yaml +++ b/charts/shopsys-app/tests/serviceaccount_test.yaml @@ -22,6 +22,9 @@ tests: - equal: path: spec.template.spec.serviceAccountName value: shopsys-app + - equal: + path: spec.template.spec.automountServiceAccountToken + value: false - it: honors a custom name template: templates/serviceaccount.yaml @@ -62,6 +65,20 @@ tests: - equal: path: spec.template.spec.serviceAccountName value: default + # pod-level automount still guarantees no token, whatever the SA itself mounts + - equal: + path: spec.template.spec.automountServiceAccountToken + value: false + + - it: mounts the token at pod level when automountToken is enabled + template: templates/deployment-webserver-php-fpm.yaml + set: + serviceAccount: + automountToken: true + asserts: + - equal: + path: spec.template.spec.automountServiceAccountToken + value: true - it: does not mount the default SA token into the migration hook template: templates/hooks/job-migrate-application.yaml diff --git a/charts/shopsys-app/values.yaml b/charts/shopsys-app/values.yaml index ede0151..ceafb85 100644 --- a/charts/shopsys-app/values.yaml +++ b/charts/shopsys-app/values.yaml @@ -66,7 +66,10 @@ imagePullSecrets: - dockerregistry # ServiceAccount the workload pods run under (the hook Jobs keep the deploy-hooks SA). -# None of the workloads talk to the Kubernetes API, so the token is not mounted. +# None of the workloads talk to the Kubernetes API, so the token is not mounted: +# automountToken is applied both on the chart-created ServiceAccount and at pod level on +# every workload pod, so it holds even with create=false (external SA or the namespace +# `default` fallback when `name` is left empty) - pod-level overrides the SA's own setting. # NOTE: the helmfile passes these values to both charts - leave `name` empty (each chart # defaults to its own chart name) or set create=false with an externally managed account; # an explicit name with create=true would make both releases fight over one ServiceAccount. diff --git a/charts/shopsys-common/templates/_helpers.tpl b/charts/shopsys-common/templates/_helpers.tpl index db82335..ec4d835 100644 --- a/charts/shopsys-common/templates/_helpers.tpl +++ b/charts/shopsys-common/templates/_helpers.tpl @@ -264,6 +264,7 @@ checksum/php-fpm: {{ printf "%s%s" ($root.Values.webserver.phpFpm.config | defau Rendered at zero indent — use `| nindent N` at the call site. */}} {{- define "shopsys.podSettings" -}} serviceAccountName: {{ include "shopsys.serviceAccountName" .root }} +automountServiceAccountToken: {{ .root.Values.serviceAccount.automountToken }} {{- with .component.nodeSelector }} nodeSelector: {{ toYaml . | indent 2 }} diff --git a/charts/shopsys-infra/tests/infra_test.yaml b/charts/shopsys-infra/tests/infra_test.yaml index 025d3f3..868722c 100644 --- a/charts/shopsys-infra/tests/infra_test.yaml +++ b/charts/shopsys-infra/tests/infra_test.yaml @@ -110,3 +110,6 @@ tests: - equal: path: spec.template.spec.serviceAccountName value: shopsys-infra + - equal: + path: spec.template.spec.automountServiceAccountToken + value: false diff --git a/charts/shopsys-infra/values.yaml b/charts/shopsys-infra/values.yaml index 33aa891..fc27f91 100644 --- a/charts/shopsys-infra/values.yaml +++ b/charts/shopsys-infra/values.yaml @@ -32,7 +32,8 @@ registry: existingSecret: "" # ServiceAccount the redis/rabbitmq pods run under; see the app chart for the shared-values -# caveat (leave `name` empty - it defaults to the chart name per chart). +# caveat (leave `name` empty - it defaults to the chart name per chart) and for the +# automountToken semantics (applied on the SA and at pod level on every workload pod). serviceAccount: create: true name: "" diff --git a/docs/migrating-from-shopsys-deployment.md b/docs/migrating-from-shopsys-deployment.md index 2c865aa..a330325 100644 --- a/docs/migrating-from-shopsys-deployment.md +++ b/docs/migrating-from-shopsys-deployment.md @@ -140,7 +140,9 @@ Intentional differences of the phase-1 rewrite; everything else is a 1:1 port. `default` ServiceAccount with its API token mounted. Each chart now creates its own ServiceAccount (`shopsys-app` / `shopsys-infra`) with `automountServiceAccountToken: false` — none of the workloads talk to the Kubernetes - API. The hook Jobs are unchanged: `cron-suspend` keeps the `deploy-hooks` SA (needs the + API. The same setting is also emitted at pod level on every workload pod, so the + no-token guarantee holds even when `serviceAccount.create=false` points at an external + account (or falls back to the namespace `default` SA). The hook Jobs are unchanged: `cron-suspend` keeps the `deploy-hooks` SA (needs the API), and the migration/post-deploy Jobs stay on the default SA (a `pre-install` hook cannot reference the chart SA, which does not exist yet) but no longer mount its token. Configure via `serviceAccount: {create, name, automountToken}`. diff --git a/docs/values.md b/docs/values.md index 395af7b..a85b41e 100644 --- a/docs/values.md +++ b/docs/values.md @@ -68,8 +68,10 @@ registry: # image pull secret; credentials sensitive → env serviceAccount: # per-chart SA the workload pods run under (no API token mounted) create: true name: "" # empty = chart name per chart; leave empty (shared values - - # an explicit name would collide between the two releases) - automountToken: false + # an explicit name would collide between the two releases); + # with create=false an empty name falls back to `default` + automountToken: false # applied on the chart SA AND at pod level on every workload + # pod - effective even with create=false (pod-level wins) app: # shared backend configuration env: {} # non-sensitive backend env vars (webserver, cron, consumers, migration) diff --git a/tests/golden/scenarios/basic-production/expected/continuous.yaml b/tests/golden/scenarios/basic-production/expected/continuous.yaml index 29b21ce..655cb47 100644 --- a/tests/golden/scenarios/basic-production/expected/continuous.yaml +++ b/tests/golden/scenarios/basic-production/expected/continuous.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1136,6 +1139,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1272,6 +1276,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1372,6 +1377,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml index ca29d9d..24e5f62 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy-with-demo-data.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1136,6 +1139,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1272,6 +1276,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1372,6 +1377,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml index 32b5a51..67be109 100644 --- a/tests/golden/scenarios/basic-production/expected/first-deploy.yaml +++ b/tests/golden/scenarios/basic-production/expected/first-deploy.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1136,6 +1139,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1272,6 +1276,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1372,6 +1377,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml index 83fed89..2c976de 100644 --- a/tests/golden/scenarios/development-single-domain/expected/continuous.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/continuous.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1134,6 +1137,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1230,6 +1234,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml index 866b5b8..b8ca1cb 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy-with-demo-data.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1134,6 +1137,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1230,6 +1234,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml index 9fd787a..8dbab3e 100644 --- a/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-single-domain/expected/first-deploy.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1134,6 +1137,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1230,6 +1234,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml index 4344462..9928a14 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/continuous.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1134,6 +1137,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1230,6 +1234,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml index 5a5c3dc..54e6081 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1134,6 +1137,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1230,6 +1234,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml index ba5bae6..1f7bc05 100644 --- a/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/development-with-cloudflare/expected/first-deploy.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -998,6 +1000,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1134,6 +1137,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1230,6 +1234,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/escaping-env/expected/continuous.yaml b/tests/golden/scenarios/escaping-env/expected/continuous.yaml index 1a7c36d..025b13b 100644 --- a/tests/golden/scenarios/escaping-env/expected/continuous.yaml +++ b/tests/golden/scenarios/escaping-env/expected/continuous.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1014,6 +1016,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1154,6 +1157,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1293,6 +1297,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1398,6 +1403,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml index d9dffea..4c64879 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy-with-demo-data.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1014,6 +1016,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1154,6 +1157,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1293,6 +1297,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1398,6 +1403,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml index 140298f..44d0fef 100644 --- a/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml +++ b/tests/golden/scenarios/escaping-env/expected/first-deploy.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1014,6 +1016,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1154,6 +1157,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1293,6 +1297,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1398,6 +1403,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml index 573665b..bf46a45 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/continuous.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -999,6 +1001,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1135,6 +1138,7 @@ spec: app: consumer-order spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1273,6 +1277,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1409,6 +1414,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1509,6 +1515,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml index bb58251..e5031e5 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy-with-demo-data.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -999,6 +1001,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1135,6 +1138,7 @@ spec: app: consumer-order spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1273,6 +1277,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1409,6 +1414,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1509,6 +1515,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: diff --git a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml index de066aa..c6e065c 100644 --- a/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml +++ b/tests/golden/scenarios/production-with-cloudflare/expected/first-deploy.yaml @@ -215,6 +215,7 @@ spec: app: redis spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false volumes: - name: health configMap: @@ -298,6 +299,7 @@ spec: app: rabbitmq spec: serviceAccountName: shopsys-infra + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -999,6 +1001,7 @@ spec: app: consumer-email spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1135,6 +1138,7 @@ spec: app: consumer-order spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1273,6 +1277,7 @@ spec: date: "1234567890" spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false tolerations: - effect: NoSchedule key: workload @@ -1409,6 +1414,7 @@ spec: app: storefront spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAntiAffinity: preferredDuringSchedulingIgnoredDuringExecution: @@ -1509,6 +1515,7 @@ spec: app: webserver-php-fpm spec: serviceAccountName: shopsys-app + automountServiceAccountToken: false affinity: podAffinity: preferredDuringSchedulingIgnoredDuringExecution: From 34f3da6656468623208e52a0ff61fb2175d92fed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20G=C3=B3recki?= Date: Thu, 20 Aug 2026 12:46:15 +0200 Subject: [PATCH 3/3] Add serviceAccount to the values schemas additionalProperties: false catches typos (e.g. automountServiceAccountToken instead of automountToken) at render time in both charts. Co-Authored-By: Claude Fable 5 --- charts/shopsys-app/values.schema.json | 9 +++++++++ charts/shopsys-infra/values.schema.json | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/charts/shopsys-app/values.schema.json b/charts/shopsys-app/values.schema.json index d28f2fe..5cc3814 100644 --- a/charts/shopsys-app/values.schema.json +++ b/charts/shopsys-app/values.schema.json @@ -63,6 +63,15 @@ } } }, + "serviceAccount": { + "type": "object", + "additionalProperties": false, + "properties": { + "create": { "type": "boolean" }, + "name": { "type": "string" }, + "automountToken": { "type": "boolean" } + } + }, "registry": { "type": "object", "properties": { diff --git a/charts/shopsys-infra/values.schema.json b/charts/shopsys-infra/values.schema.json index d921201..b187b29 100644 --- a/charts/shopsys-infra/values.schema.json +++ b/charts/shopsys-infra/values.schema.json @@ -12,6 +12,15 @@ "environment": { "type": "string" } } }, + "serviceAccount": { + "type": "object", + "additionalProperties": false, + "properties": { + "create": { "type": "boolean" }, + "name": { "type": "string" }, + "automountToken": { "type": "boolean" } + } + }, "redis": { "type": "object", "properties": {