update some tests

library/common-test/tests/configmap/name_test.yaml

@@ -24,13 +24,13 @@ tests:
         equal:
           path: metadata.name
           value: release-name-common-test-my-configmap1
-      - documentIndex: &configmapDoc2 1
+      - documentIndex: &otherConfigmapDoc 1
         isKind:
           of: ConfigMap
-      - documentIndex: *configmapDoc2
+      - documentIndex: *otherConfigmapDoc
         isAPIVersion:
           of: v1
-      - documentIndex: *configmapDoc2
+      - documentIndex: *otherConfigmapDoc
         equal:
           path: metadata.name
           value: release-name-common-test-my-configmap2

library/common-test/tests/controller/names_test.yaml

@@ -10,11 +10,27 @@ tests:
           primary: true
           type: Deployment
           podSpec: {}
-        other-controller-name:
+        daemonset-controller-name:
           enabled: true
           primary: false
           type: DaemonSet
           podSpec: {}
+        stateful-controller-name:
+          enabled: true
+          primary: false
+          type: StatefulSet
+          podSpec: {}
+        cronjob-controller-name:
+          enabled: true
+          primary: false
+          type: CronJob
+          schedule: "*/1 * * * *"
+          podSpec: {}
+        job-controller-name:
+          enabled: true
+          primary: false
+          type: Job
+          podSpec: {}
     asserts:
       - documentIndex: &deploymentDoc 0
         isKind:
@@ -26,7 +42,17 @@ tests:
         equal:
           path: metadata.name
           value: release-name-common-test
-      - documentIndex: &daemonSetDoc 1
+      - documentIndex: &cronJobDoc 1
+        isKind:
+          of: CronJob
+      - documentIndex: *cronJobDoc
+        isAPIVersion:
+          of: batch/v1
+      - documentIndex: *cronJobDoc
+        equal:
+          path: metadata.name
+          value: release-name-common-test-cronjob-controller-name
+      - documentIndex: &daemonSetDoc 2
         isKind:
           of: DaemonSet
       - documentIndex: *daemonSetDoc
@@ -35,4 +61,24 @@ tests:
       - documentIndex: *daemonSetDoc
         equal:
           path: metadata.name
-          value: release-name-common-test-other-controller-name
+          value: release-name-common-test-daemonset-controller-name
+      - documentIndex: &jobDoc 3
+        isKind:
+          of: Job
+      - documentIndex: *jobDoc
+        isAPIVersion:
+          of: batch/v1
+      - documentIndex: *jobDoc
+        equal:
+          path: metadata.name
+          value: release-name-common-test-job-controller-name
+      - documentIndex: &statefulSetDoc 4
+        isKind:
+          of: StatefulSet
+      - documentIndex: *statefulSetDoc
+        isAPIVersion:
+          of: apps/v1
+      - documentIndex: *statefulSetDoc
+        equal:
+          path: metadata.name
+          value: release-name-common-test-stateful-controller-name

library/common-test/tests/imagePullSecret/name_test.yaml

@@ -30,13 +30,13 @@ tests:
         equal:
           path: metadata.name
           value: release-name-common-test-my-pull-secret1
-      - documentIndex: &secretDoc2 1
+      - documentIndex: &otherSecretDoc 1
         isKind:
           of: Secret
-      - documentIndex: *secretDoc2
+      - documentIndex: *otherSecretDoc
         isAPIVersion:
           of: v1
-      - documentIndex: *secretDoc2
+      - documentIndex: *otherSecretDoc
         equal:
           path: metadata.name
           value: release-name-common-test-my-pull-secret2

library/common-test/tests/secret/name_test.yaml

@@ -24,13 +24,13 @@ tests:
         equal:
           path: metadata.name
           value: release-name-common-test-my-secret1
-      - documentIndex: &secretDoc2 1
+      - documentIndex: &otherSecretDoc 1
         isKind:
           of: Secret
-      - documentIndex: *secretDoc2
+      - documentIndex: *otherSecretDoc
         isAPIVersion:
           of: v1
-      - documentIndex: *secretDoc2
+      - documentIndex: *otherSecretDoc
         equal:
           path: metadata.name
           value: release-name-common-test-my-secret2

library/common-test/tests/serviceAccount/metadata_test.yaml

@@ -0,0 +1,54 @@
+suite: service account metadata test
+templates:
+  - common.yaml
+chart:
+  appVersion: &appVer v9.9.9
+tests:
+  - it: should pass with service account created with labels and annotations
+    set:
+      label1: label1
+      label2: global_label2
+      annotation1: annotation1
+      annotation2: global_annotation2
+      global:
+        labels:
+          g_label1: global_label1
+          g_label2: "{{ .Values.label2 }}"
+        annotations:
+          g_annotation1: global_annotation1
+          g_annotation2: "{{ .Values.annotation2 }}"
+      serviceAccounts:
+        my-sa1:
+          enabled: true
+          labels:
+            label1: "{{ .Values.label1 }}"
+            label2: label2
+          annotations:
+            annotation1: "{{ .Values.annotation1 }}"
+            annotation2: annotation2
+    asserts:
+      - documentIndex: &serviceAccountDoc 0
+        isKind:
+          of: ServiceAccount
+      - documentIndex: *serviceAccountDoc
+        equal:
+          path: metadata.annotations
+          value:
+            annotation1: annotation1
+            annotation2: annotation2
+            g_annotation1: global_annotation1
+            g_annotation2: global_annotation2
+      - documentIndex: *serviceAccountDoc
+        equal:
+          path: metadata.labels
+          value:
+            app: common-test-1.0.0
+            release: release-name
+            helm-revision: 0
+            helm.sh/chart: common-test-1.0.0
+            app.kubernetes.io/managed-by: Helm
+            app.kubernetes.io/version: *appVer
+            g_label1: global_label1
+            g_label2: global_label2
+            label1: label1
+            label2: label2

library/common-test/tests/serviceAccount/name_test.yaml

@@ -0,0 +1,45 @@
+suite: service account name test
+templates:
+  - common.yaml
+tests:
+  - it: should generate correct name
+    set:
+      serviceAccounts:
+        my-sa1:
+          enabled: true
+        my-sa2:
+          enabled: true
+        main:
+          enabled: true
+          primary: true
+    asserts:
+      - documentIndex: &primaryServiceAccount 0
+        isKind:
+          of: ServiceAccount
+      - documentIndex: *primaryServiceAccount
+        isAPIVersion:
+          of: v1
+      - documentIndex: *primaryServiceAccount
+        equal:
+          path: metadata.name
+          value: release-name-common-test
+      - documentIndex: &serviceAccount 1
+        isKind:
+          of: ServiceAccount
+      - documentIndex: *serviceAccount
+        isAPIVersion:
+          of: v1
+      - documentIndex: *serviceAccount
+        equal:
+          path: metadata.name
+          value: release-name-common-test-my-sa1
+      - documentIndex: &otherServiceAccount 2
+        isKind:
+          of: ServiceAccount
+      - documentIndex: *otherServiceAccount
+        isAPIVersion:
+          of: v1
+      - documentIndex: *otherServiceAccount
+        equal:
+          path: metadata.name
+          value: release-name-common-test-my-sa2

library/common-test/tests/serviceAccount/validation_test.yaml

@@ -0,0 +1,56 @@
+suite: service account validation test
+templates:
+  - common.yaml
+tests:
+  - it: should fail with name longer than 63 characters
+    set:
+      serviceAccounts:
+        my-service-account-super-long-name-that-is-longer-than-63-characters:
+          enabled: true
+    asserts:
+      - failedTemplate:
+          errorMessage: Name [release-name-common-test-my-service-account-super-long-name-that-is-longer-than-63-characters] is not valid. Must start and end with an alphanumeric character. It can contain '-'. And must be at most 63 characters.
+
+  - it: should fail with name starting with underscore
+    set:
+      serviceAccounts:
+        _my-sa:
+          enabled: true
+          data:
+            foo: bar
+    asserts:
+      - failedTemplate:
+          errorMessage: Name [release-name-common-test-_my-sa] is not valid. Must start and end with an alphanumeric character. It can contain '-'. And must be at most 63 characters.
+
+  - it: should fail with labels not a dict
+    set:
+      serviceAccounts:
+        my-sa:
+          enabled: true
+          labels: "not a dict"
+    asserts:
+      - failedTemplate:
+          errorMessage: Service Account - Expected <labels> to be a dictionary, but got [string]
+
+  - it: should fail with annotations not a dict
+    set:
+      serviceAccounts:
+        my-sa:
+          enabled: true
+          annotations: "not a dict"
+    asserts:
+      - failedTemplate:
+          errorMessage: Service Account - Expected <annotations> to be a dictionary, but got [string]
+
+  - it: should fail with more than 1 primary service accounts
+    set:
+      serviceAccounts:
+        my-sa:
+          enabled: true
+          primary: true
+        my-sa2:
+          enabled: true
+          primary: true
+    asserts:
+      - failedTemplate:
+          errorMessage: Service Account - Only one service account can be primary

library/common/1.0.0/docs/serviceAccounts.md

@@ -5,6 +5,7 @@
 | serviceAccounts                           |  `dict`   |    ❌    |      ❌       |  `{}`   | Define the serviceAccounts as dicts                     |
 | serviceAccounts.[sa-name]                 |  `dict`   |    ✅    |      ❌       |  `{}`   | Holds secret definition                                 |
 | serviceAccounts.[sa-name].enabled         | `boolean` |    ✅    |      ❌       | `false` | Enables or Disables the secret                          |
+| serviceAccounts.[sa-name].primary         | `boolean` |    ❌    |      ❌       | `false` | Sets the service account as primary                     |
 | serviceAccounts.[sa-name].labels          |  `dict`   |    ❌    |      ✅       |  `{}`   | Additional labels for secret                            |
 | serviceAccounts.[sa-name].annotations     |  `dict`   |    ❌    |      ✅       |  `{}`   | Additional annotations for secret                       |
 | serviceAccounts.[sa-name].targetSelectAll | `boolean` |    ❌    |      ❌       |         | Whether to assign the serviceAccount to all pods or not |
@@ -24,7 +25,8 @@ Appears in:
 
 Naming scheme:
 
-- `$FullName-$ServiceAccountName` (release-name-chart-name-ServiceAccountName)
+- Primary: `$FullName` (release-name-chart-name)
+- Non-Primary: `$FullName-$ServiceAccountName` (release-name-chart-name-ServiceAccountName)
 
 ---
 

library/common/1.0.0/templates/lib/controller/_pod.tpl

@@ -9,6 +9,7 @@ objectData: The object data to be used to render the Pod.
   {{- $objectData := .objectData -}}
 serviceAccountName: {{ include "ix.v1.common.lib.pod.serviceAccountName" (dict "rootCtx" $rootCtx "objectData" $objectData) }}
 automountServiceAccountToken: {{ include "ix.v1.common.lib.pod.automountServiceAccountToken" (dict "rootCtx" $rootCtx "objectData" $objectData) }}
+runtimeClassName: {{ include "ix.v1.common.lib.pod.runtimeClassName" (dict "rootCtx" $rootCtx "objectData" $objectData) }}
   {{- with (include "ix.v1.common.lib.pod.imagePullSecrets" (dict "rootCtx" $rootCtx "objectData" $objectData) | trim) }}
 imagePullSecrets:
     {{-  . | nindent 2 }}
@@ -41,7 +42,6 @@ terminationGracePeriodSeconds: {{ . }}
 tolerations:
     {{- . | nindent 2 }}
   {{- end }}
-#TODO:runtimeClassName:
 #TODO:securityContext:
 #TODO:containers:
 #TODO:initContainers:

library/common/1.0.0/templates/lib/serviceAccount/_validation.tpl

@@ -0,0 +1,57 @@
+{{/* Service Account Validation */}}
+{{/* Call this template:
+{{ include "ix.v1.common.lib.serviceAccount.validation" (dict "objectData" $objectData) -}}
+objectData:
+  labels: The labels of the serviceAccount.
+  annotations: The annotations of the serviceAccount.
+  data: The data of the serviceAccount.
+*/}}
+
+{{- define "ix.v1.common.lib.serviceAccount.validation" -}}
+  {{- $objectData := .objectData -}}
+
+  {{- if and $objectData.labels (not (kindIs "map" $objectData.labels)) -}}
+    {{- fail (printf "Service Account - Expected <labels> to be a dictionary, but got [%v]" (kindOf $objectData.labels)) -}}
+  {{- end -}}
+
+  {{- if and $objectData.annotations (not (kindIs "map" $objectData.annotations)) -}}
+    {{- fail (printf "Service Account - Expected <annotations> to be a dictionary, but got [%v]" (kindOf $objectData.annotations)) -}}
+  {{- end -}}
+
+{{- end -}}
+
+{{/* Service Account Primary Validation */}}
+{{/* Call this template:
+{{ include "ix.v1.common.lib.serviceAccount.primaryValidation" (dict "objectData" $objectData) -}}
+objectData:
+  labels: The labels of the serviceAccount.
+  annotations: The annotations of the serviceAccount.
+  data: The data of the serviceAccount.
+*/}}
+
+{{- define "ix.v1.common.lib.serviceAccount.primaryValidation" -}}
+
+  {{/* Initialize values */}}
+  {{- $hasPrimary := false -}}
+
+  {{- range $name, $serviceAccount := .Values.serviceAccounts -}}
+
+    {{/* If service account is enabled */}}
+    {{- if $serviceAccount.enabled -}}
+
+      {{/* And service account is primary */}}
+      {{- if and (hasKey $serviceAccount "primary") ($serviceAccount.primary) -}}
+
+        {{/* Fail if there is already a primary service account */}}
+        {{- if $hasPrimary -}}
+          {{- fail "Service Account - Only one service account can be primary" -}}
+        {{- end -}}
+
+        {{- $hasPrimary = true -}}
+
+      {{- end -}}
+
+    {{- end -}}
+  {{- end -}}
+
+{{- end -}}

library/common/1.0.0/templates/spawner/_serviceAccount.tpl

@@ -5,6 +5,9 @@
 
 {{- define "ix.v1.common.spawner.serviceAccounts" -}}
 
+  {{/* Primary validation for enabled service accounts. */}}
+  {{- include "ix.v1.common.lib.serviceAccount.primaryValidation" $ -}}
+
   {{- range $name, $serviceAccount := .Values.serviceAccounts -}}
 
     {{- if $serviceAccount.enabled -}}
@@ -12,10 +15,14 @@
       {{/* Create a copy of the configmap */}}
       {{- $objectData := (mustDeepCopy $serviceAccount) -}}
 
-      {{- $objectName := (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $) $name) -}}
+      {{- $objectName := include "ix.v1.common.lib.chart.names.fullname" $ -}}
+      {{- if not $objectData.primary -}}
+        {{- $objectName = (printf "%s-%s" (include "ix.v1.common.lib.chart.names.fullname" $) $name) -}}
+      {{- end -}}
 
       {{/* Perform validations */}}
       {{- include "ix.v1.common.lib.chart.names.validation" (dict "name" $objectName) -}}
+      {{- include "ix.v1.common.lib.serviceAccount.validation" (dict "objectData" $objectData) -}}
 
       {{/* Set the name of the service account */}}
       {{- $_ := set $objectData "name" $objectName -}}

library/common/1.0.0/values.yaml

@@ -6,6 +6,9 @@ global:
   annotations: {}
   # -- Scale Storage Class
   scaleZFSStorageClass: '{{ printf "ix-storage-class-%v" .Release.Name }}'
+  ixChartContext:
+    addNvidiaRuntimeClass: true
+    nvidiaRuntimeClassName: asdf
 
 # TODO:
 fallbackDefaults:
@@ -121,6 +124,7 @@ podOptions:
   tolerations: []
   schedulerName: ""
   priorityClassName: ""
+  runtimeClassName: ""
   automountServiceAccountToken: false
   terminationGracePeriodSeconds: 120
   # TODO: Add affinity