From 65fc1d809188f73f83ce48d14bcec17f27b5db3f Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Sun, 13 Sep 2026 12:56:45 +0300 Subject: [PATCH 1/2] feat(chart): opt-in serviceAccount.name and podLabels serviceAccount.name renders serviceAccountName on the pod spec. podLabels adds labels to the pod template only, never the selector, with every value quoted. Both are empty by default, so the default render is byte-identical to before. This lets a release run as an existing ServiceAccount bound to an Azure Workload Identity (serviceAccount.name plus the azure.workload.identity/use pod label) without a Helm post-renderer. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Umepkp3PVYEjJSi9v3j9Xs --- charts/default/README.md | 2 ++ charts/default/templates/deployment.yaml | 6 ++++++ charts/default/values.yaml | 10 ++++++++++ 3 files changed, 18 insertions(+) diff --git a/charts/default/README.md b/charts/default/README.md index 373f6889..6da1c3d0 100644 --- a/charts/default/README.md +++ b/charts/default/README.md @@ -86,3 +86,5 @@ concerns. |-----|---------|-------------| | `service.type` | `ClusterIP` | Service type. | | `service.port` | `80` | Service port (also the default `HTTPRoute` backend port). | +| `serviceAccount.name` | `''` | Existing ServiceAccount the pod runs as, e.g. one bound to an Azure Workload Identity. Empty renders no `serviceAccountName`. The chart does not create it. | +| `podLabels` | `{}` | Extra labels on the pod template only, never the selector. Values render as strings, e.g. `--set podLabels.azure\.workload\.identity/use=true`. | diff --git a/charts/default/templates/deployment.yaml b/charts/default/templates/deployment.yaml index 70bd3e30..c8c2f906 100644 --- a/charts/default/templates/deployment.yaml +++ b/charts/default/templates/deployment.yaml @@ -20,9 +20,15 @@ spec: app: {{ template "project.name" . }} draft: {{ .Values.draft | default "draft-app" }} release: {{ .Release.Name }} + {{- range $key, $value := .Values.podLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} annotations: buildID: {{ .Values.buildID | default "" | quote }} spec: + {{- with .Values.serviceAccount.name }} + serviceAccountName: {{ . }} + {{- end }} {{- if .Values.hostAliases }} hostAliases: {{- range .Values.hostAliases }} diff --git a/charts/default/values.yaml b/charts/default/values.yaml index c3d56ad1..4aef392f 100644 --- a/charts/default/values.yaml +++ b/charts/default/values.yaml @@ -109,6 +109,16 @@ tolerations: [] affinity: {} +# Existing ServiceAccount for the pod to run as, e.g. one bound to an Azure Workload Identity. +# Empty (default) renders no serviceAccountName, so the namespace's default ServiceAccount is used. +# The chart does not create the ServiceAccount. +serviceAccount: + name: '' + +# Extra labels on the pod template only, never the selector. Values always render as strings. +# e.g. --set podLabels.azure\.workload\.identity/use=true +podLabels: {} + # db is the connection string for the database db: "" From ee872e33d5ac40ae0e29054a7c06ff3128e731df Mon Sep 17 00:00:00 2001 From: Musa Misto <64855513+MusaMisto@users.noreply.github.com> Date: Sun, 13 Sep 2026 13:07:26 +0300 Subject: [PATCH 2/2] fix(chart): quote serviceAccountName and reject reserved podLabels keys A numeric-looking ServiceAccount name such as 123 rendered as a YAML integer, which the API rejects. The podLabels keys app, draft and release duplicated the chart's own pod labels without any render or lint error. app and release are also the selector labels. The chart now fails with a clear message instead. The podLabels examples now quote the --set argument, so the escaped dots survive the shell. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Umepkp3PVYEjJSi9v3j9Xs --- charts/default/README.md | 2 +- charts/default/templates/deployment.yaml | 5 ++++- charts/default/values.yaml | 3 ++- 3 files changed, 7 insertions(+), 3 deletions(-) diff --git a/charts/default/README.md b/charts/default/README.md index 6da1c3d0..f629a8c4 100644 --- a/charts/default/README.md +++ b/charts/default/README.md @@ -87,4 +87,4 @@ concerns. | `service.type` | `ClusterIP` | Service type. | | `service.port` | `80` | Service port (also the default `HTTPRoute` backend port). | | `serviceAccount.name` | `''` | Existing ServiceAccount the pod runs as, e.g. one bound to an Azure Workload Identity. Empty renders no `serviceAccountName`. The chart does not create it. | -| `podLabels` | `{}` | Extra labels on the pod template only, never the selector. Values render as strings, e.g. `--set podLabels.azure\.workload\.identity/use=true`. | +| `podLabels` | `{}` | Extra labels on the pod template only, never the selector. Values render as strings, e.g. `--set 'podLabels.azure\.workload\.identity/use=true'`. `app`, `draft` and `release` are set by the chart and can't be overridden. | diff --git a/charts/default/templates/deployment.yaml b/charts/default/templates/deployment.yaml index c8c2f906..bdf613bb 100644 --- a/charts/default/templates/deployment.yaml +++ b/charts/default/templates/deployment.yaml @@ -21,13 +21,16 @@ spec: draft: {{ .Values.draft | default "draft-app" }} release: {{ .Release.Name }} {{- range $key, $value := .Values.podLabels }} + {{- if has $key (list "app" "draft" "release") }} + {{- fail (printf "podLabels.%s is set by the chart and can't be overridden" $key) }} + {{- end }} {{ $key }}: {{ $value | quote }} {{- end }} annotations: buildID: {{ .Values.buildID | default "" | quote }} spec: {{- with .Values.serviceAccount.name }} - serviceAccountName: {{ . }} + serviceAccountName: {{ . | quote }} {{- end }} {{- if .Values.hostAliases }} hostAliases: diff --git a/charts/default/values.yaml b/charts/default/values.yaml index 4aef392f..67b1e802 100644 --- a/charts/default/values.yaml +++ b/charts/default/values.yaml @@ -116,7 +116,8 @@ serviceAccount: name: '' # Extra labels on the pod template only, never the selector. Values always render as strings. -# e.g. --set podLabels.azure\.workload\.identity/use=true +# app, draft and release are set by the chart and can't be overridden. +# e.g. --set 'podLabels.azure\.workload\.identity/use=true' podLabels: {} # db is the connection string for the database