Add service account and role/rolebinding

manifests/helm/flink-cdc-session/0.1.0/templates/_helpers.tpl

@@ -12,6 +12,24 @@ Fully qualified name: Release.Name (chart name 중복 시 제거)
 {{- .Release.Name | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
+{{/*
+ServiceAccount name
+*/}}
+{{- define "flink-cdc-session.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "flink-cdc-session.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Truststore secret name
+*/}}
+{{- define "flink-cdc-session.truststoreSecretName" -}}
+{{- default (printf "%s-flink-truststore" (include "flink-cdc-session.fullname" .)) .Values.truststore.secretName }}
+{{- end }}
+
 {{/*
 Common labels
 */}}

manifests/helm/flink-cdc-session/0.1.0/templates/flinkdeployment.yaml

@@ -33,7 +33,7 @@ spec:
       -Djavax.net.ssl.trustStorePassword={{ .Values.truststore.password }}
       -Djavax.net.ssl.trustStoreType=JKS
     {{- end }}
-  serviceAccount: {{ .Values.serviceAccount }}
+  serviceAccount: {{ include "flink-cdc-session.serviceAccountName" . }}
   jobManager:
     replicas: {{ .Values.jobManager.replicas }}
     resource:
@@ -94,7 +94,7 @@ spec:
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
-            secretName: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
+            secretName: {{ include "flink-cdc-session.truststoreSecretName" . }}
         {{- end }}
         {{- if eq .Values.checkpointStorage.storageType "gcs" }}
         - name: gcs-key

manifests/helm/flink-cdc-session/0.1.0/templates/job.yaml

@@ -10,7 +10,7 @@ spec:
   backoffLimit: 0
   template:
     spec:
-      serviceAccountName: {{ .Values.serviceAccount }}
+      serviceAccountName: {{ include "flink-cdc-session.serviceAccountName" . }}
       containers:
         - name: submit
           image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
@@ -69,7 +69,7 @@ spec:
         {{- if .Values.truststore.enabled }}
         - name: truststore
           secret:
-            secretName: {{ include "flink-cdc-session.fullname" . }}-flink-truststore
+            secretName: {{ include "flink-cdc-session.truststoreSecretName" . }}
         {{- end }}
         {{- if eq .Values.checkpointStorage.storageType "gcs" }}
         - name: gcs-key

manifests/helm/flink-cdc-session/0.1.0/templates/role.yaml

@@ -0,0 +1,25 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "flink-cdc-session.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-session.labels" . | nindent 4 }}
+rules:
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch", "create", "delete", "patch"]
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "list", "create", "delete"]
+  - apiGroups: [""]
+    resources: ["events"]
+    verbs: ["create", "patch"]
+  - apiGroups: ["apps"]
+    resources: ["deployments", "replicasets"]
+    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
+{{- end }}

manifests/helm/flink-cdc-session/0.1.0/templates/rolebinding.yaml

@@ -0,0 +1,17 @@
+{{- if .Values.rbac.create }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "flink-cdc-session.fullname" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-session.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: {{ include "flink-cdc-session.fullname" . }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "flink-cdc-session.serviceAccountName" . }}
+    namespace: {{ .Release.Namespace }}
+{{- end }}

manifests/helm/flink-cdc-session/0.1.0/templates/serviceaccount.yaml

@@ -0,0 +1,9 @@
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "flink-cdc-session.serviceAccountName" . }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "flink-cdc-session.labels" . | nindent 4 }}
+{{- end }}