37 lines
1.3 KiB
YAML
37 lines
1.3 KiB
YAML
{{- /*
|
||
ServiceAccount — 当 serviceAccount.create=true 时创建。
|
||
workloadIdentity.enabled=true 时：
|
||
1) automountServiceAccountToken=false（禁用默认 token 投递）
|
||
2) 额外创建 type=service-account-token 的 Secret（projected token），供 KMS/HSM 使用
|
||
*/ -}}
|
||
{{- if .Values.serviceAccount.create }}
|
||
apiVersion: v1
|
||
kind: ServiceAccount
|
||
metadata:
|
||
name: {{ include "agentkit.serviceAccountName" . }}
|
||
labels:
|
||
{{- include "agentkit.labels" . | nindent 4 }}
|
||
{{- with .Values.serviceAccount.annotations }}
|
||
annotations:
|
||
{{- toYaml . | nindent 4 }}
|
||
{{- end }}
|
||
{{- if .Values.workloadIdentity.enabled }}
|
||
automountServiceAccountToken: false
|
||
{{- end }}
|
||
{{- end }}
|
||
{{- if and .Values.serviceAccount.create .Values.workloadIdentity.enabled }}
|
||
---
|
||
# ponytail: projected SA token — 限时令牌，供 KMS/HSM workload identity 换取访问凭据。
|
||
# 升级路径：云厂商原生 workload identity 注解（P1，避免手动 token 投递）。
|
||
apiVersion: v1
|
||
kind: Secret
|
||
metadata:
|
||
name: {{ include "agentkit.serviceAccountName" . }}-token
|
||
namespace: {{ .Release.Namespace }}
|
||
labels:
|
||
{{- include "agentkit.labels" . | nindent 4 }}
|
||
annotations:
|
||
kubernetes.io/service-account.name: {{ include "agentkit.serviceAccountName" . }}
|
||
type: kubernetes.io/service-account-token
|
||
{{- end }}
|