Allow using Workload Identity with helm chart (#70)

estafette · Apr 10, 2020 · dcf02c8 · dcf02c8
1 parent 11c4df5
commit dcf02c8
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 1 deletion.
diff --git a/helm/estafette-gke-preemptible-killer/templates/deployment.yaml b/helm/estafette-gke-preemptible-killer/templates/deployment.yaml
@@ -53,8 +53,10 @@ spec:
               value: {{ .Values.drainTimeout | quote }}
             - name: INTERVAL
               value: {{ .Values.interval | quote }}
+            {{- if not .Values.secret.workloadIdentityServiceAccount }}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /gcp-service-account/service-account-key.json
+            {{- end }}
             {{- range $key, $value := .Values.extraEnv }}
             - name: {{ $key }}
               value: {{ $value }}
@@ -71,14 +73,18 @@ spec:
             timeoutSeconds: 5
           resources:
             {{- toYaml .Values.resources | nindent 12 }}
+          {{- if not .Values.secret.workloadIdentityServiceAccount }}
           volumeMounts:
           - name: gcp-service-account-secret
             mountPath: /gcp-service-account
+          {{- end }}
       terminationGracePeriodSeconds: 300
+      {{- if not .Values.secret.workloadIdentityServiceAccount }}
       volumes:
       - name: gcp-service-account-secret
         secret:
           secretName: {{ include "estafette-gke-preemptible-killer.fullname" . }}
+      {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector:
         {{- toYaml . | nindent 8 }}

diff --git a/helm/estafette-gke-preemptible-killer/templates/secret.yaml b/helm/estafette-gke-preemptible-killer/templates/secret.yaml
@@ -1,3 +1,4 @@
+{{- if not .Values.secret.workloadIdentityServiceAccount }}
 apiVersion: v1
 kind: Secret
 metadata:
@@ -18,4 +19,5 @@ data:
   {{- else }}
   service-account-key.json: {{.Values.secret.googleServiceAccountKeyfileJson | toString | b64enc}}
   {{- end }}
-{{- end }}
+{{- end }}
+{{- end }}
diff --git a/helm/estafette-gke-preemptible-killer/templates/serviceaccount.yaml b/helm/estafette-gke-preemptible-killer/templates/serviceaccount.yaml
@@ -6,4 +6,8 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
 {{ include "estafette-gke-preemptible-killer.labels" . | indent 4 }}
+  {{- if .Values.secret.workloadIdentityServiceAccount }}
+  annotations:
+    iam.gke.io/gcp-service-account: {{ .Values.secret.workloadIdentityServiceAccount }}
+  {{- end }}
 {{- end -}}
diff --git a/helm/estafette-gke-preemptible-killer/values.yaml b/helm/estafette-gke-preemptible-killer/values.yaml
@@ -19,6 +19,9 @@ secret:
   # when using estafette-gcp-service account controller to fetch key files, set this to true and leave googleServiceAccountKeyfileJson empty
   useGcpServiceAccountAnnotation: false
 
+  # when using workload identity set this to the Google Cloud Service Account
+  workloadIdentityServiceAccount: ""
+
   # sets a json keyfile for a gcp service account
   googleServiceAccountKeyfileJson: '{"type": "service_account"}'