Address review: move kubectl under cleaner, remove global additions

Signed-off-by: Md. Istiak <mdistiak@appscode.com>

Author: Istiak2019331114

charts/service-gateway/templates/_helpers.tpl

@@ -81,36 +81,3 @@ Returns if ubi images are to be used
 {{- define "operator.ubi" -}}
 {{ ternary "-ubi" "" (list "operator" "all" | has (default (dig "ubi" "" (default dict .Values.distro)) .Values.global.distro.ubi)) }}
 {{- end }}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "appscode.serviceAccountName" -}}
-{{- if .Values.global.serviceAccount.create }}
-{{- default (include "service-gateway.fullname" .) .Values.global.serviceAccount.name }}
-{{- else if .Values.serviceAccount }}
-{{- default "default" .Values.serviceAccount.name }}
-{{- else }}
-{{- "default" }}
-{{- end }}
-{{- end }}
-
-{{/*
-Returns the registry used for kubectl docker image
-*/}}
-{{- define "kubectl.registry" -}}
-{{- list .Values.global.registryFQDN (default .Values.kubectl.registry .Values.global.registry) | compact | join "/" }}
-{{- end }}
-
-{{/*
-Returns the appscode image pull secrets
-*/}}
-{{- define "appscode.imagePullSecrets" -}}
-{{- with .Values.global.imagePullSecrets -}}
-imagePullSecrets:
-{{- toYaml . | nindent 2 }}
-{{- else -}}
-imagePullSecrets:
-{{- toYaml $.Values.imagePullSecrets | nindent 2 }}
-{{- end }}
-{{- end }}

charts/service-gateway/templates/cleaner/job.yaml

@@ -12,16 +12,8 @@ spec:
   backoffLimit: 3
   template:
     spec:
-      {{- include "appscode.imagePullSecrets" . | nindent 6 }}
       serviceAccountName: {{ include "service-gateway.fullname" . }}-gwclass-cleaner
       automountServiceAccountToken: true
-      {{- if eq "true" ( include "distro.openshift" . ) }}
-      securityContext:
-        {{- toYaml (omit .Values.cleaner.podSecurityContext "runAsUser" "runAsGroup" "fsGroup" "supplementalGroups") | nindent 8 }}
-      {{- else }}
-      securityContext:
-        {{- toYaml .Values.cleaner.podSecurityContext | nindent 8 }}
-      {{- end }}
       containers:
         - name: kubectl
           {{- if eq "true" ( include "distro.openshift" . ) }}
@@ -31,8 +23,8 @@ spec:
           securityContext:
             {{- toYaml .Values.cleaner.securityContext | nindent 12 }}
           {{- end }}
-          image: "{{ include "kubectl.registry" . }}/{{ .Values.kubectl.repository }}:{{ .Values.kubectl.tag }}"
-          imagePullPolicy: {{ .Values.kubectl.pullPolicy }}
+          image: "{{ .Values.cleaner.kubectl.registry }}/{{ .Values.cleaner.kubectl.repository }}:{{ .Values.cleaner.kubectl.tag }}"
+          imagePullPolicy: {{ .Values.cleaner.kubectl.pullPolicy }}
           command:
           - /bin/sh
           - -c

charts/service-gateway/templates/cleaner/serviceaccount.yaml

@@ -1,4 +1,4 @@
-{{- if and .Values.cleaner.enabled .Values.global.serviceAccount.create -}}
+{{- if .Values.cleaner.enabled -}}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -7,5 +7,5 @@ metadata:
   annotations:
     "helm.sh/hook-weight": "-5"
     "helm.sh/hook": post-delete
-    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded,hook-succeeded
+    "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded
 {{- end }}

charts/service-gateway/values.yaml

@@ -14,18 +14,6 @@ global:
     # Set operator or all to use ubi images
     ubi: ""
 
-  # Docker registry used to pull app related images
-  registry: ""
-  registryFQDN: ghcr.io
-  imagePullSecrets: []
-
-  serviceAccount:
-    create: true
-    annotations: {}
-    # The name of the service account to use.
-    # If not set and create is true, a name is generated using the fullname template
-    name: ""
-
 clusterMetadata:
   uid: tbd
   name: tbd
@@ -157,22 +145,16 @@ vaultServer:
   # Vault server namespace that exist on cluster
   namespace: "ace"
 
-kubectl:
-  registry: appscode
-  repository: kubectl-nonroot
-  tag: "1.34"
-  pullPolicy: IfNotPresent
-
-# Pre-delete hook that strips the GatewayClass finalizer so the chart uninstalls cleanly.
+# Post-delete hook that strips the GatewayClass finalizer so the chart uninstalls cleanly.
 # Disabled by default. Enable when the envoy-gateway controller is deployed as a sub-chart
 # and shuts down before it can remove the finalizer.
 cleaner:
   enabled: false
-  podSecurityContext:
-    runAsNonRoot: true
-    runAsUser: 65534
-    seccompProfile:
-      type: RuntimeDefault
+  kubectl:
+    registry: ghcr.io/appscode
+    repository: kubectl-nonroot
+    tag: "1.34"
+    pullPolicy: IfNotPresent
   securityContext:
     allowPrivilegeEscalation: false
     capabilities: