fix(migrations) add Kuma compatibility

Add SAT volume and volume hint to migrations Pod templates.
Kong · Aug 24, 2023 · 8fc8244 · 8fc8244
1 parent a2d4072
commit 8fc8244
Show file tree

Hide file tree

Showing 3 changed files with 114 additions and 0 deletions.
diff --git a/charts/kong/templates/migrations-post-upgrade.yaml b/charts/kong/templates/migrations-post-upgrade.yaml
@@ -29,6 +29,9 @@ spec:
       {{- range $key, $value := .Values.migrations.annotations }}
         {{ $key }}: {{ $value | quote }}
       {{- end }}
+      {{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
+        kuma.io/service-account-token-volume: {{ template "kong.serviceAccountTokenName" . }}
+      {{- end }}
       {{- end }}
     spec:
       {{- if or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name }}
@@ -85,5 +88,40 @@ spec:
       volumes:
       {{- include "kong.volumes" . | nindent 6 -}}
       {{- include "kong.userDefinedVolumes" . | nindent 6 -}}
+      {{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
+      - name: {{ template "kong.serviceAccountTokenName" . }}
+        {{- /* Due to GKE versions (e.g. v1.23.15-gke.1900) we need to handle pre-release part of the version as well.
+        See the related documentation of semver module that Helm depends on for semverCompare:
+        https://github.com/Masterminds/semver#working-with-prerelease-versions
+        Related Helm issue: https://github.com/helm/helm/issues/3810 */}}
+        {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }}
+        projected:
+          sources:
+          - serviceAccountToken:
+              expirationSeconds: 3607
+              path: token
+          - configMap:
+              items:
+              - key: ca.crt
+                path: ca.crt
+              name: kube-root-ca.crt
+          - downwardAPI:
+              items:
+              - fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+                path: namespace
+        {{- else }}
+        secret:
+          secretName: {{ template "kong.serviceAccountTokenName" . }}
+          items:
+          - key: token
+            path: token
+          - key: ca.crt
+            path: ca.crt
+          - key: namespace
+            path: namespace
+        {{- end }}
+      {{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/kong/templates/migrations-pre-upgrade.yaml b/charts/kong/templates/migrations-pre-upgrade.yaml
@@ -31,6 +31,9 @@ spec:
       {{- range $key, $value := .Values.migrations.annotations }}
         {{ $key }}: {{ $value | quote }}
       {{- end }}
+      {{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
+        kuma.io/service-account-token-volume: {{ template "kong.serviceAccountTokenName" . }}
+      {{- end }}
       {{- end }}
     spec:
       {{- if or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name }}
@@ -87,5 +90,40 @@ spec:
       volumes:
       {{- include "kong.volumes" . | nindent 6 -}}
       {{- include "kong.userDefinedVolumes" . | nindent 6 -}}
+      {{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
+      - name: {{ template "kong.serviceAccountTokenName" . }}
+        {{- /* Due to GKE versions (e.g. v1.23.15-gke.1900) we need to handle pre-release part of the version as well.
+        See the related documentation of semver module that Helm depends on for semverCompare:
+        https://github.com/Masterminds/semver#working-with-prerelease-versions
+        Related Helm issue: https://github.com/helm/helm/issues/3810 */}}
+        {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }}
+        projected:
+          sources:
+          - serviceAccountToken:
+              expirationSeconds: 3607
+              path: token
+          - configMap:
+              items:
+              - key: ca.crt
+                path: ca.crt
+              name: kube-root-ca.crt
+          - downwardAPI:
+              items:
+              - fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+                path: namespace
+        {{- else }}
+        secret:
+          secretName: {{ template "kong.serviceAccountTokenName" . }}
+          items:
+          - key: token
+            path: token
+          - key: ca.crt
+            path: ca.crt
+          - key: namespace
+            path: namespace
+        {{- end }}
+      {{- end }}
 {{- end }}
 {{- end }}
diff --git a/charts/kong/templates/migrations.yaml b/charts/kong/templates/migrations.yaml
@@ -39,6 +39,9 @@ spec:
       {{- range $key, $value := .Values.migrations.annotations }}
         {{ $key }}: {{ $value | quote }}
       {{- end }}
+      {{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
+        kuma.io/service-account-token-volume: {{ template "kong.serviceAccountTokenName" . }}
+      {{- end }}
       {{- end }}
     spec:
       {{- if or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name }}
@@ -95,6 +98,41 @@ spec:
       volumes:
       {{- include "kong.volumes" . | nindent 6 -}}
       {{- include "kong.userDefinedVolumes" . | nindent 6 -}}
+      {{- if (and (not .Values.deployment.serviceAccount.automountServiceAccountToken) (or .Values.deployment.serviceAccount.create .Values.deployment.serviceAccount.name)) }}
+      - name: {{ template "kong.serviceAccountTokenName" . }}
+        {{- /* Due to GKE versions (e.g. v1.23.15-gke.1900) we need to handle pre-release part of the version as well.
+        See the related documentation of semver module that Helm depends on for semverCompare:
+        https://github.com/Masterminds/semver#working-with-prerelease-versions
+        Related Helm issue: https://github.com/helm/helm/issues/3810 */}}
+        {{- if semverCompare ">=1.20.0-0" .Capabilities.KubeVersion.Version }}
+        projected:
+          sources:
+          - serviceAccountToken:
+              expirationSeconds: 3607
+              path: token
+          - configMap:
+              items:
+              - key: ca.crt
+                path: ca.crt
+              name: kube-root-ca.crt
+          - downwardAPI:
+              items:
+              - fieldRef:
+                  apiVersion: v1
+                  fieldPath: metadata.namespace
+                path: namespace
+        {{- else }}
+        secret:
+          secretName: {{ template "kong.serviceAccountTokenName" . }}
+          items:
+          - key: token
+            path: token
+          - key: ca.crt
+            path: ca.crt
+          - key: namespace
+            path: namespace
+        {{- end }}
+      {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}