diff --git a/helm/librechat/templates/deployment.yaml b/helm/librechat/templates/deployment.yaml index 9f6e4f624..492edafdb 100755 --- a/helm/librechat/templates/deployment.yaml +++ b/helm/librechat/templates/deployment.yaml @@ -30,6 +30,7 @@ spec: imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} + serviceAccountName: {{ include "librechat.serviceAccountName" . }} securityContext: {{- toYaml .Values.podSecurityContext | nindent 8 }} containers: diff --git a/helm/librechat/templates/serviceaccount.yaml b/helm/librechat/templates/serviceaccount.yaml new file mode 100644 index 000000000..983f9069f --- /dev/null +++ b/helm/librechat/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "librechat.serviceAccountName" . }} + labels: + {{- include "librechat.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automount }} +{{- end }} diff --git a/helm/librechat/values.yaml b/helm/librechat/values.yaml index f14b5e227..f290766d1 100755 --- a/helm/librechat/values.yaml +++ b/helm/librechat/values.yaml @@ -115,6 +115,17 @@ imagePullSecrets: [] nameOverride: "" fullnameOverride: "" +# This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/ +serviceAccount: + # Specifies whether a service account should be created + create: true + # Automatically mount a ServiceAccount's API credentials? + automount: true + # Annotations to add to the service account + annotations: {} + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + name: "" lifecycle: {} # # base for adding a custom banner // see https://github.com/danny-avila/LibreChat/pull/3952 for an example