chore: addon controller use kb sa (#9572)

(cherry picked from commit 13d89eb)

Author: ldming

controllers/extensions/addon_controller_stages.go

@@ -62,7 +62,7 @@ const (
 )
 
 func init() {
-	viper.SetDefault(addonSANameKey, "kubeblocks-addon-installer")
+	viper.SetDefault(constant.KBServiceAccountName, "kubeblocks")
 	viper.SetDefault(addonHelmInstallOptKey, []string{
 		"--atomic",
 		"--cleanup-on-fail",
@@ -598,7 +598,6 @@ func (r *helmTypeInstallStage) Handle(ctx context.Context) {
 			chartsPath,
 			"--namespace",
 			"$(RELEASE_NS)",
-			"--create-namespace",
 		}, viper.GetStringSlice(addonHelmInstallOptKey)...)
 
 		installValues := addon.Spec.Helm.BuildMergedValues(addon.Spec.InstallSpec)
@@ -916,19 +915,7 @@ func createHelmJobProto(addon *extensionsv1alpha1.Addon) (*batchv1.Job, error) {
 		Name:            getJobMainContainerName(addon),
 		Image:           viper.GetString(constant.KBToolsImage),
 		ImagePullPolicy: corev1.PullPolicy(viper.GetString(constant.CfgAddonJobImgPullPolicy)),
-		// TODO: need have image that is capable of following settings, current settings
-		// may expose potential security risk, as this pod is using cluster-admin clusterrole.
-		// SecurityContext: &corev1.SecurityContext{
-		//	RunAsNonRoot:             &[]bool{true}[0],
-		//	RunAsUser:                &[]int64{1001}[0],
-		//	AllowPrivilegeEscalation: &[]bool{false}[0],
-		//	Capabilities: &corev1.Capabilities{
-		//		Drop: []corev1.Capability{
-		//			"ALL",
-		//		},
-		//	},
-		// },
-		Command: []string{"helm"},
+		Command:         []string{"helm"},
 		Env: []corev1.EnvVar{
 			{
 				Name:  "RELEASE_NAME",
@@ -966,7 +953,7 @@ func createHelmJobProto(addon *extensionsv1alpha1.Addon) (*batchv1.Job, error) {
 				},
 				Spec: corev1.PodSpec{
 					RestartPolicy:      corev1.RestartPolicyNever,
-					ServiceAccountName: viper.GetString("KUBEBLOCKS_ADDON_SA_NAME"),
+					ServiceAccountName: viper.GetString(constant.KBServiceAccountName),
 					Containers:         []corev1.Container{container},
 					Volumes:            []corev1.Volume{},
 					Tolerations:        []corev1.Toleration{},

controllers/extensions/const.go

@@ -54,7 +54,6 @@ const (
 
 	// config keys used in viper
 	maxConcurrentReconcilesKey = "MAXCONCURRENTRECONCILES_ADDON"
-	addonSANameKey             = "KUBEBLOCKS_ADDON_SA_NAME"
 	addonHelmInstallOptKey     = "KUBEBLOCKS_ADDON_HELM_INSTALL_OPTIONS"
 	addonHelmUninstallOptKey   = "KUBEBLOCKS_ADDON_HELM_UNINSTALL_OPTIONS"
 )

deploy/helm/templates/_helpers.tpl

@@ -61,13 +61,6 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
-{{/*
-Create the addon installer name of the service account to use
-*/}}
-{{- define "kubeblocks.addonSAName" -}}
-{{- printf "%s-%s" (include "kubeblocks.serviceAccountName" .) "addon-installer" }}
-{{- end }}
-
 {{/*
 Create the name of the webhook service.
 */}}

deploy/helm/templates/deployment.yaml

@@ -146,8 +146,6 @@ spec:
             - name: ADDON_JOB_IMAGE_PULL_POLICY
               value: {{ .jobImagePullPolicy | default "IfNotPresent" }}
             {{- end }}
-            - name: KUBEBLOCKS_ADDON_SA_NAME
-              value: {{ include "kubeblocks.addonSAName" . }}
             - name: KUBEBLOCKS_ADDON_HELM_INSTALL_OPTIONS
               value: {{ join " " .Values.addonHelmInstallOptions }}
             - name: KUBEBLOCKS_ADDON_CHARTS_IMAGE_PULL_POLICY

deploy/helm/templates/rbac/clusterrole_binding.yaml

@@ -11,22 +11,4 @@ roleRef:
 subjects:
 - kind: ServiceAccount
   name: {{ include "kubeblocks.serviceAccountName" . }}
-  namespace: {{ .Release.Namespace }}
-
-{{- if ( include "kubeblocks.addonControllerEnabled" . ) | deepEqual "true" }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ include "kubeblocks.fullname" . }}-cluster-admin-rolebinding
-  labels:
-    {{- include "kubeblocks.labels" . | nindent 4 }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: cluster-admin
-subjects:
-  - kind: ServiceAccount
-    name: {{ include "kubeblocks.addonSAName" . }}
-    namespace: {{ .Release.Namespace }}
-{{- end }}
+  namespace: {{ .Release.Namespace }}

deploy/helm/templates/serviceaccount.yaml

@@ -14,24 +14,6 @@ imagePullSecrets:
     {{- toYaml . | nindent 2 }}
   {{- end }}
 
-{{- if ( include "kubeblocks.addonControllerEnabled" . ) | deepEqual "true" }}
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "kubeblocks.addonSAName" . }}
-  labels:
-    {{- include "kubeblocks.labels" . | nindent 4 }}
-    {{- with .Values.serviceAccount.annotations }}
-  annotations:
-      {{- toYaml . | nindent 4 }}
-    {{- end }}
-  {{- with .Values.addonChartsImage.pullSecrets }}
-imagePullSecrets:
-    {{- toYaml . | nindent 2 }}
-  {{- end }}
-{{- end }}
-
 {{- if and .Values.dataProtection.enabled }}
 ---
 apiVersion: v1

deploy/helm/values.yaml

@@ -453,7 +453,7 @@ backupRepo:
     accessKeyId: ""
     secretAccessKey: ""
 
-  ## Addon controller settings, this will require cluster-admin clusterrole.
+  ## Addon controller settings
   ##
   ## @param addonController.enabled
   ## @param addonController.jobTTL - is addon job time-to-live period, this value is time.Duration-parseable string.