Always use dedicated service account in device-plugin helm chart

Signed-off-by: Christopher Desiniotis <[email protected]>

Author: cdesiniotis

deployments/helm/nvidia-device-plugin/templates/daemonset-device-plugin.yml

@@ -15,7 +15,6 @@
 {{- if .Values.devicePlugin.enabled }}
 ---
 {{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- $useServiceAccount := $options.hasConfigMap }}
 {{- $configMapName := (include "nvidia-device-plugin.configMapName" .) | trim }}
 {{- $daemonsetName := printf "%s" (include "nvidia-device-plugin.fullname" .) | trunc 63 | trimSuffix "-" }}
 apiVersion: apps/v1
@@ -52,9 +51,7 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if $useServiceAccount }}
       serviceAccountName: {{ include "nvidia-device-plugin.fullname" . }}-service-account
-      {{- end }}
       {{- if $options.hasConfigMap }}
       shareProcessNamespace: true
       initContainers:

deployments/helm/nvidia-device-plugin/templates/daemonset-gfd.yml

@@ -15,7 +15,6 @@
 {{- if .Values.gfd.enabled }}
 ---
 {{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- $useServiceAccount := or ( $options.hasConfigMap ) ( and .Values.gfd.enabled .Values.nfd.enableNodeFeatureApi ) }}
 {{- $configMapName := (include "nvidia-device-plugin.configMapName" .) | trim }}
 {{- $daemonsetName := printf "%s-gpu-feature-discovery" (include "nvidia-device-plugin.fullname" .) | trunc 63 | trimSuffix "-" }}
 apiVersion: apps/v1
@@ -52,9 +51,7 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if $useServiceAccount }}
       serviceAccountName: {{ include "nvidia-device-plugin.fullname" . }}-service-account
-      {{- end }}
       {{- if $options.hasConfigMap }}
       shareProcessNamespace: true
       {{- end }}

deployments/helm/nvidia-device-plugin/templates/daemonset-mps-control-daemon.yml

@@ -50,12 +50,10 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if $options.hasConfigMap }}
       serviceAccountName: {{ include "nvidia-device-plugin.fullname" . }}-service-account
       {{- if not .Values.mps.enableHostPID }}
       shareProcessNamespace: true
       {{- end }}
-      {{- end }}
       {{- if .Values.mps.enableHostPID }}
       hostPID: true
       {{- end }}

deployments/helm/nvidia-device-plugin/templates/role-binding.yml

@@ -1,6 +1,4 @@
 ---
-{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- if or $options.hasConfigMap ( and .Values.gfd.enabled .Values.nfd.enableNodeFeatureApi ) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -15,4 +13,3 @@ roleRef:
   kind: ClusterRole
   name: {{ include "nvidia-device-plugin.fullname" . }}-role
   apiGroup: rbac.authorization.k8s.io
-{{- end }}

deployments/helm/nvidia-device-plugin/templates/role.yml

@@ -1,6 +1,4 @@
 ---
-{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- if or $options.hasConfigMap ( and .Values.gfd.enabled .Values.nfd.enableNodeFeatureApi ) }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -16,4 +14,3 @@ rules:
     resources: ["nodefeatures"]
     verbs: ["get", "list", "watch", "create", "update"]
   {{- end }}
-{{- end }}

deployments/helm/nvidia-device-plugin/templates/service-account.yml

@@ -1,11 +1,8 @@
 ---
-{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- if or $options.hasConfigMap ( and .Values.gfd.enabled .Values.nfd.enableNodeFeatureApi ) }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "nvidia-device-plugin.fullname" . }}-service-account
   namespace: {{ include "nvidia-device-plugin.namespace" . }}
   labels:
     {{- include "nvidia-device-plugin.labels" . | nindent 4 }}
-{{- end }}