martin-mat opened a new pull request, #1026: URL: https://github.com/apache/apisix-helm-chart/pull/1026
Fixes #1025. With default values the APISIX pods run as the namespace's `default` ServiceAccount: `serviceAccount.create` is `false`, and `apisix.serviceAccountName` then falls back to `default`. The `apisix-dashboard` chart creates its own account by default, and the `apisix-ingress-controller` chart always does. **Change** - `charts/apisix/values.yaml`: `serviceAccount.create` defaults to `true`. The chart creates `<fullname>` and the Deployment uses it; the templates already support this (#278). - `rbac.create` stays `false`, so the new account has no permissions. Kubernetes service discovery still needs `rbac.create: true`, as before. - `serviceAccount.create: false` keeps the previous behaviour, and `serviceAccount.name` still selects an existing account. - `charts/apisix/README.md`: regenerated default; chart version 2.18.2 → 2.18.3. **Upgrade note.** A user who enabled Kubernetes service discovery and granted `endpoints` access to the namespace's `default` account by hand, instead of through `rbac.create`, would lose it, because the pods move to the new account. `serviceAccount.create: false` keeps that setup. **Verification** Standalone mode on kind, CNTi test suite v2.3.0, master and this branch side by side ([run](https://github.com/martin-mat/apisix-helm-chart/actions/runs/39148581504)): | | master | this branch | |---|---|---| | APISIX pod's ServiceAccount | `default` | `apisix` (its own, no permissions) | | `dedicated_service_account` | failed | passed | | CNTi essential tests | 15 of 19 | 15 of 19 | | A request through the gateway | `404 Route Not Found` from APISIX | `404 Route Not Found` from APISIX | This repository's CI (`ct lint`, `ct install`, helm-docs) passed on the change on the fork ([run](https://github.com/martin-mat/apisix-helm-chart/actions/runs/39148581193), Kubernetes 1.22 and 1.23). The chart renders with `serviceAccount.create: false` (pods on `default`) and with `serviceAccount.name` (the named account) as expected. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
