Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dummy service accounts to hook-image-puller and continuous-image-puller pods #3594

Merged
merged 5 commits into from
Jan 12, 2025
+73 −0
Merged

Add dummy service accounts to hook-image-puller and continuous-image-puller pods #3594

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a417772
fix(prepuller): Add dummy service accounts to hook-image-puller and c…
Jun 23, 2024
351cd20
Use the same hook weight on the SA as the DaemonSet that will need it
consideRatio Jan 10, 2025
28b1db3
ci: test configuration of dummy SA for image pullers
consideRatio Jan 10, 2025
69581cd
Let helper functions for image puller SA names be relevant or empty
consideRatio Jan 10, 2025
6ffc084
Add image puller SA names to the list of resource names
consideRatio Jan 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions jupyterhub/templates/_helpers-names.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,11 +196,21 @@
{{- include "jupyterhub.fullname.dash" . }}hook-image-puller
{{- end }}

{{- /* hook-image-puller ServiceAccount */}}
{{- define "jupyterhub.hook-image-puller-serviceaccount.fullname" -}}
{{- .Values.prePuller.hook.serviceAccountImagePuller.name | default (include "jupyterhub.hook-image-puller.fullname" .) }}
{{- end }}

{{- /* continuous-image-puller DaemonSet */}}
{{- define "jupyterhub.continuous-image-puller.fullname" -}}
{{- include "jupyterhub.fullname.dash" . }}continuous-image-puller
{{- end }}

{{- /* continuous-image-puller ServiceAccount */}}
{{- define "jupyterhub.continuous-image-puller-serviceaccount.fullname" -}}
{{- .Values.prePuller.continuous.serviceAccount.name | default (include "jupyterhub.continuous-image-puller.fullname" .) }}
{{- end }}

{{- /* singleuser NetworkPolicy */}}
{{- define "jupyterhub.singleuser.fullname" -}}
{{- include "jupyterhub.fullname.dash" . }}singleuser
Expand Down Expand Up @@ -298,7 +308,9 @@ image-puller-priority: {{ include "jupyterhub.image-puller-priority.fullname" .
hook-image-awaiter: {{ include "jupyterhub.hook-image-awaiter.fullname" . | quote }}
hook-image-awaiter-serviceaccount: {{ include "jupyterhub.hook-image-awaiter-serviceaccount.fullname" . | quote }}
hook-image-puller: {{ include "jupyterhub.hook-image-puller.fullname" . | quote }}
hook-image-puller-serviceaccount: {{ include "jupyterhub.hook-image-puller-serviceaccount.fullname" . | quote }}
continuous-image-puller: {{ include "jupyterhub.continuous-image-puller.fullname" . | quote }}
continuous-image-puller-serviceaccount: {{ include "jupyterhub.continuous-image-puller-serviceaccount.fullname" . | quote }}
singleuser: {{ include "jupyterhub.singleuser.fullname" . | quote }}
image-pull-secret: {{ include "jupyterhub.image-pull-secret.fullname" . | quote }}
ingress: {{ include "jupyterhub.ingress.fullname" . | quote }}
Expand Down
9 changes: 9 additions & 0 deletions jupyterhub/templates/image-puller/_helpers-daemonset.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,15 @@ spec:
{{- include "jupyterhub.userNodeAffinityRequired" . | nindent 14 }}
{{- end }}
terminationGracePeriodSeconds: 0
{{- if .hook }}
{{- with include "jupyterhub.hook-image-puller-serviceaccount.fullname" . }}
serviceAccountName: {{ . }}
{{- end }}
{{- else }}
{{- with include "jupyterhub.continuous-image-puller-serviceaccount.fullname" . }}
serviceAccountName: {{ . }}
{{- end }}
{{- end }}
consideRatio marked this conversation as resolved.
Show resolved Hide resolved
automountServiceAccountToken: false
{{- with include "jupyterhub.imagePullSecrets" (dict "root" . "image" .Values.singleuser.image) }}
imagePullSecrets: {{ . }}
Expand Down
17 changes: 17 additions & 0 deletions jupyterhub/templates/image-puller/serviceaccount-continuous.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
{{- /*
ServiceAccount for the continuous image-puller daemonset
*/}}
{{- if .Values.prePuller.continuous.serviceAccount.create -}}
{{- if .Values.prePuller.continuous.enabled -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "jupyterhub.continuous-image-puller.fullname" . }}
labels:
{{- include "jupyterhub.labels" . | nindent 4 }}
annotations:
{{- with .Values.prePuller.continuous.serviceAccount.annotations }}
{{- . | toYaml | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}
21 changes: 21 additions & 0 deletions jupyterhub/templates/image-puller/serviceaccount-hook.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
{{- /*
ServiceAccount for the hook image-puller daemonset
*/}}
{{- if .Values.prePuller.hook.serviceAccountImagePuller.create -}}
{{- if (include "jupyterhub.imagePuller.daemonset.hook.install" .) -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "jupyterhub.hook-image-puller-serviceaccount.fullname" . }}
labels:
{{- include "jupyterhub.labels" . | nindent 4 }}
hub.jupyter.org/deletable: "true"
annotations:
"helm.sh/hook": pre-install,pre-upgrade
"helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
"helm.sh/hook-weight": "-10"
{{- with .Values.prePuller.hook.serviceAccountImagePuller.annotations }}
{{- . | toYaml | nindent 4 }}
{{- end }}
{{- end }}
{{- end }}
2 changes: 2 additions & 0 deletions jupyterhub/values.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2864,6 +2864,7 @@ properties:
image: *image-spec
resources: *resources-spec
serviceAccount: *serviceAccount
serviceAccountImagePuller: *serviceAccount
continuous:
type: object
additionalProperties: false
Expand All @@ -2880,6 +2881,7 @@ properties:
properties:
enabled:
type: boolean
serviceAccount: *serviceAccount
pullProfileListImages:
type: boolean
description: |
Expand Down
10 changes: 10 additions & 0 deletions jupyterhub/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -665,12 +665,22 @@ prePuller:
nodeSelector: {}
tolerations: []
resources: {}
# Service Account for the hook-image-awaiter Job
serviceAccount:
create: true
name:
annotations: {}
# Service Account for the hook-image-puller DaemonSet
serviceAccountImagePuller:
create: true
name:
annotations: {}
continuous:
enabled: true
serviceAccount:
create: true
name:
annotations: {}
pullProfileListImages: true
extraImages: {}
pause:
Expand Down
2 changes: 2 additions & 0 deletions tools/templates/lint-and-validate-values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -563,8 +563,10 @@ prePuller:
value: mock-taint-value-hook
effect: NoSchedule
serviceAccount: *serviceAccount
serviceAccountImagePuller: *serviceAccount
continuous:
enabled: true
serviceAccount: *serviceAccount
extraImages:
mockImage1:
name: mock-user/mock-image1
Expand Down
Loading