{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/helm/issues/3320","repository_url":"https://api.github.com/repos/kubernetes/helm","labels_url":"https://api.github.com/repos/kubernetes/helm/issues/3320/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/helm/issues/3320/comments","events_url":"https://api.github.com/repos/kubernetes/helm/issues/3320/events","html_url":"https://github.com/kubernetes/helm/issues/3320","id":286859903,"number":3320,"title":"Proposal: RBAC best-practices changes","user":{"login":"omkensey","id":8946309,"avatar_url":"https://avatars3.githubusercontent.com/u/8946309?v=4","gravatar_id":"","url":"https://api.github.com/users/omkensey","html_url":"https://github.com/omkensey","followers_url":"https://api.github.com/users/omkensey/followers","following_url":"https://api.github.com/users/omkensey/following{/other_user}","gists_url":"https://api.github.com/users/omkensey/gists{/gist_id}","starred_url":"https://api.github.com/users/omkensey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/omkensey/subscriptions","organizations_url":"https://api.github.com/users/omkensey/orgs","repos_url":"https://api.github.com/users/omkensey/repos","events_url":"https://api.github.com/users/omkensey/events{/privacy}","received_events_url":"https://api.github.com/users/omkensey/received_events","type":"User","site_admin":false},"labels":[{"id":562687520,"url":"https://api.github.com/repos/kubernetes/helm/labels/feature","name":"feature","color":"0052cc","default":false},{"id":269212354,"url":"https://api.github.com/repos/kubernetes/helm/labels/help%20wanted","name":"help wanted","color":"006b75","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/helm/milestones/16","html_url":"https://github.com/kubernetes/helm/milestone/16","labels_url":"https://api.github.com/repos/kubernetes/helm/milestones/16/labels","id":1916661,"number":16,"title":"Upcoming - Minor","description":"Features to be triaged into an upcoming minor version release","creator":{"login":"technosophos","id":89193,"avatar_url":"https://avatars1.githubusercontent.com/u/89193?v=4","gravatar_id":"","url":"https://api.github.com/users/technosophos","html_url":"https://github.com/technosophos","followers_url":"https://api.github.com/users/technosophos/followers","following_url":"https://api.github.com/users/technosophos/following{/other_user}","gists_url":"https://api.github.com/users/technosophos/gists{/gist_id}","starred_url":"https://api.github.com/users/technosophos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/technosophos/subscriptions","organizations_url":"https://api.github.com/users/technosophos/orgs","repos_url":"https://api.github.com/users/technosophos/repos","events_url":"https://api.github.com/users/technosophos/events{/privacy}","received_events_url":"https://api.github.com/users/technosophos/received_events","type":"User","site_admin":false},"open_issues":55,"closed_issues":98,"state":"open","created_at":"2016-08-01T19:38:32Z","updated_at":"2018-02-21T08:53:00Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2018-01-08T19:34:34Z","updated_at":"2018-02-22T19:56:50Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"(Ref: RBAC comments in jetstack/cert-manager#229, Helm issue #3098)\r\n\r\nIn discussion of a Jetstack PR, I have come to believe we need to at least update the best practices doc for RBAC in charts, and possibly refactor those practices.\r\n\r\nThe bit that needs updating is the current assertion that \"serviceAccountName is effectively a required value\".  It should be optional, but generated to a unique name if not specified.\r\n\r\nHowever, additional cases not handled by the current practice are:\r\n* a service account already exists, and a new release should create RBAC or other resources that use it\r\n* a service account should be created for an RBAC-enabled chart even when RBAC is not being used\r\n\r\nIn the Jetstack PR discussion, it was proposed that service account values should be split out from RBAC (since they are used by RBAC but exist independently of it) and created or not independently, e.g.:\r\n\r\n```\r\nrbac:\r\n  create: true\r\n\r\nserviceAccount:\r\n  create: false\r\n  serviceAccountName: \"foo\"\r\n```\r\n\r\nThis adds a bit of complexity, but resolves the issue described above, and additionally allows charts to specify and use multiple service accounts if we add a layer under `serviceAccount` like so:\r\n\r\n```\r\nserviceAccounts:\r\n  client:\r\n    serviceAccountName: client-account\r\n    create: false\r\n  server:\r\n    serviceAccountName: server-account\r\n    create: true\r\n```\r\n\r\nMy personal feeling is that the additional functionality, especially of the second form, is worth the small added complexity.\r\n  "},"comment":{"url":"https://api.github.com/repos/kubernetes/helm/issues/comments/367802069","html_url":"https://github.com/kubernetes/helm/issues/3320#issuecomment-367802069","issue_url":"https://api.github.com/repos/kubernetes/helm/issues/3320","id":367802069,"user":{"login":"depohmel","id":1631779,"avatar_url":"https://avatars0.githubusercontent.com/u/1631779?v=4","gravatar_id":"","url":"https://api.github.com/users/depohmel","html_url":"https://github.com/depohmel","followers_url":"https://api.github.com/users/depohmel/followers","following_url":"https://api.github.com/users/depohmel/following{/other_user}","gists_url":"https://api.github.com/users/depohmel/gists{/gist_id}","starred_url":"https://api.github.com/users/depohmel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depohmel/subscriptions","organizations_url":"https://api.github.com/users/depohmel/orgs","repos_url":"https://api.github.com/users/depohmel/repos","events_url":"https://api.github.com/users/depohmel/events{/privacy}","received_events_url":"https://api.github.com/users/depohmel/received_events","type":"User","site_admin":false},"created_at":"2018-02-22T19:56:50Z","updated_at":"2018-02-22T19:56:50Z","author_association":"NONE","body":"Oohhhh. Thanks. This was a missing part. Now it does make sense. "}}
{"actor":{"display_login":"depohmel"}}