Implement serviceAccount support for clickhouse pod

Author: Laurence Gill

charts/posthog/ALL_VALUES.md

@@ -620,7 +620,11 @@ The following table lists the configurable parameters of the PostHog chart and t
 | clickhouse.image.tag | string | `"22.8.11.15"` | ClickHouse image tag. Note: PostHog does not support all versions of ClickHouse. Please override the default only if you know what you are doing. |
 | clickhouse.image.pullPolicy | string | `"IfNotPresent"` | Image pull policy |
 | clickhouse.image.pullSecrets | list | `[]` |  |
+| clickhouse.serviceAccount.create | bool | `false` | serviceAccount should be created - boolean |
+| clickhouse.serviceAccount.name | string | `nil` | name of the serviceAccount |
+| clickhouse.serviceAccount.annotations | object | `{}` | Configures annotation for the serviceAccount |
 | clickhouse.tolerations | list | `[]` | Toleration labels for clickhouse pod assignment |
+| clickhouse.serviceAccountName | string | `""` | Override serviceAccountName for clickhouse pod Note: this will override serviceAccount.name if both are set |
 | clickhouse.affinity | object | `{}` | Affinity settings for clickhouse pod |
 | clickhouse.resources | object | `{}` | Clickhouse resource requests/limits. See more at http://kubernetes.io/docs/user-guide/compute-resources/ |
 | clickhouse.securityContext.enabled | bool | `true` |  |

charts/posthog/templates/_helpers.tpl

@@ -178,6 +178,12 @@ Create the name of the service account to use
 {{- end -}}
 {{- end -}}
 
+{{- define "posthog.clickhouse.serviceAccount" -}}
+{{- if .Values.clickhouse.serviceAccount.create -}}
+    {{ default "clickhouse-serviceaccount" .Values.clickhouse.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
 {{- define "posthog.helmOperation" -}}
 {{- if .Release.IsUpgrade -}}
     upgrade

charts/posthog/templates/clickhouse-serviceaccount.yaml

@@ -0,0 +1,12 @@
+{{- if .Values.clickhouse.enabled }}
+{{- if .Values.clickhouse.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "posthog.clickhouse.serviceAccount" . }}
+  labels: {{- include "_snippet-metadata-labels-common" . | nindent 4 }}
+  {{- if .Values.clickhouse.serviceAccount.annotations }}
+  annotations: {{ toYaml .Values.clickhouse.serviceAccount.annotations | nindent 4 }}
+  {{- end }}
+{{- end -}}
+{{- end -}}

charts/posthog/templates/clickhouse_instance.yaml

@@ -71,6 +71,11 @@ spec:
         podDistribution: {{ toYaml .Values.clickhouse.podDistribution | nindent 12 }}
         {{- end}}
         spec:
+          {{- if .Values.clickhouse.serviceAccountName }}
+          serviceAccountName: {{ toYaml .Values.clickhouse.serviceAccountName | nindent 12 }}
+          {{- else if .Values.clickhouse.serviceAccount.create }}
+          serviceAccountName: {{ template "posthog.clickhouse.serviceAccount" . }}
+          {{- end }}
           {{- if .Values.clickhouse.affinity }}
           affinity: {{ toYaml .Values.clickhouse.affinity | nindent 12 }}
           {{- end }}

charts/posthog/values.yaml

@@ -1732,8 +1732,21 @@ clickhouse:
     ##
     pullSecrets: []
 
+  serviceAccount:
+    # -- Alternative serviceAccount for clickhouse pod to use
+    # @default autogenerated by posthog.serviceAccount
+    # -- serviceAccount should be created - boolean
+    create: false
+    # -- name of the serviceAccount
+    name:
+    # -- Configures annotation for the serviceAccount
+    annotations: {}
+
   # -- Toleration labels for clickhouse pod assignment
   tolerations: []
+  # -- Override serviceAccountName for clickhouse pod
+  # Note: this will override serviceAccount.name if both are set
+  serviceAccountName: ""
   # -- Affinity settings for clickhouse pod
   affinity: {}
   # -- Clickhouse resource requests/limits. See more at http://kubernetes.io/docs/user-guide/compute-resources/