added service account and rbac for istio ressources

Author: wlanboy

javahttpclient-chart/templates/deployment.yaml

@@ -11,12 +11,21 @@ spec:
     metadata:
       labels:
         app: {{ .Values.deploymentname }}
+        # Aktiviert die automatische Istio-Sidecar Injection
         sidecar.istio.io/inject: "true"
     spec:
+      # Hier wird der neue ServiceAccount zugewiesen
+      serviceAccountName: {{ include "mychart.fullname" . }}-sa
       containers:
         - name: {{ .Values.deploymentname }}
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
+          env:
+            # Hilfreich für den K8sDiagnosticService, falls das File-Reading fehlschlägt
+            - name: KUBERNETES_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
           ports:
             - containerPort: {{ .Values.service.targetPort }}
           volumeMounts:
@@ -42,4 +51,4 @@ spec:
           configMap:
             name: {{ .Values.deploymentname }}-config
         - name: tmp-volume
-          emptyDir: {}
+          emptyDir: {}

javahttpclient-chart/templates/rbac.yaml

@@ -0,0 +1,27 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "java-http-client.fullname" . }}-diagnostic-role
+rules:
+  # Standard Ressourcen für den Kontext
+  - apiGroups: [""]
+    resources: ["pods", "namespaces", "services", "endpoints"]
+    verbs: ["get", "list", "watch"]
+  
+  # Istio spezifische Ressourcen für die Netzwerkanalyse
+  - apiGroups: ["networking.istio.io"]
+    resources: ["virtualservices", "destinationrules", "sidecars", "gateways"]
+    verbs: ["get", "list", "watch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ include "java-http-client.fullname" . }}-diagnostic-binding
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "java-http-client.fullname" . }}-sa
+    namespace: {{ .Release.Namespace }}
+roleRef:
+  kind: ClusterRole
+  name: {{ include "java-http-client.fullname" . }}-diagnostic-role
+  apiGroup: rbac.authorization.k8s.io

javahttpclient-chart/templates/serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "java-http-client.fullname" . }}-sa
+  namespace: {{ .Release.Namespace }}
+  labels:
+    {{- include "java-http-client.labels" . | nindent 4 }}
+automountServiceAccountToken: true