50 lines
2.8 KiB
YAML
50 lines
2.8 KiB
YAML
{{- if (.Values.serviceAccount.operator).create | default .Values.serviceAccount.create -}}
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
labels:
|
|
app.kubernetes.io/name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
|
{{- if .Values.podIdentity.azureWorkload.enabled }}
|
|
azure.workload.identity/use: "true"
|
|
{{- end }}
|
|
{{- include "keda.labels" . | nindent 4 }}
|
|
{{- if or .Values.podIdentity.azureWorkload.enabled .Values.podIdentity.aws.irsa.enabled ((.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations) .Values.podIdentity.gcp.enabled }}
|
|
annotations:
|
|
{{- if .Values.additionalAnnotations }}
|
|
{{- toYaml .Values.additionalAnnotations | nindent 4 }}
|
|
{{- end }}
|
|
{{- if .Values.podIdentity.azureWorkload.enabled }}
|
|
{{- if .Values.podIdentity.azureWorkload.clientId }}
|
|
azure.workload.identity/client-id: {{ .Values.podIdentity.azureWorkload.clientId | quote }}
|
|
{{- end }}
|
|
{{- if .Values.podIdentity.azureWorkload.tenantId }}
|
|
azure.workload.identity/tenant-id: {{ .Values.podIdentity.azureWorkload.tenantId | quote }}
|
|
{{- end }}
|
|
azure.workload.identity/service-account-token-expiration: {{ .Values.podIdentity.azureWorkload.tokenExpiration | quote }}
|
|
{{- end }}
|
|
{{- if .Values.podIdentity.aws.irsa.enabled }}
|
|
{{- if .Values.podIdentity.aws.irsa.audience }}
|
|
eks.amazonaws.com/audience: {{ .Values.podIdentity.aws.irsa.audience | quote }}
|
|
{{- end }}
|
|
{{- if .Values.podIdentity.aws.irsa.roleArn }}
|
|
eks.amazonaws.com/role-arn: {{ .Values.podIdentity.aws.irsa.roleArn | quote }}
|
|
{{- end }}
|
|
{{- if .Values.podIdentity.aws.irsa.stsRegionalEndpoints }}
|
|
eks.amazonaws.com/sts-regional-endpoints: {{ .Values.podIdentity.aws.irsa.stsRegionalEndpoints | quote }}
|
|
{{- end }}
|
|
eks.amazonaws.com/token-expiration: {{ .Values.podIdentity.aws.irsa.tokenExpiration | quote }}
|
|
{{- end }}
|
|
{{- if .Values.podIdentity.gcp.enabled }}
|
|
{{- if .Values.podIdentity.gcp.gcpIAMServiceAccount }}
|
|
iam.gke.io/gcp-service-account: {{ .Values.podIdentity.gcp.gcpIAMServiceAccount }}
|
|
{{- end }}
|
|
{{- end }}
|
|
{{- if (.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations }}
|
|
{{- toYaml ((.Values.serviceAccount.operator).annotations | default .Values.serviceAccount.annotations) | nindent 4}}
|
|
{{- end }}
|
|
{{- end }}
|
|
name: {{ (.Values.serviceAccount.operator).name | default .Values.serviceAccount.name }}
|
|
namespace: {{ .Release.Namespace }}
|
|
automountServiceAccountToken: {{ kindIs "invalid" (.Values.serviceAccount.operator).automountServiceAccountToken | ternary .Values.serviceAccount.automountServiceAccountToken (.Values.serviceAccount.operator).automountServiceAccountToken }}
|
|
{{- end -}}
|