Add serviceAccount config

Rub21 · Rub21 · commit 8cd42fe5e581 · 2025-10-17T16:59:24.000-05:00
diff --git a/osm-seed/templates/db/db-backup-job.yaml b/osm-seed/templates/db/db-backup-job.yaml
@@ -19,6 +19,9 @@ spec:
       ttlSecondsAfterFinished: 300
       template:
         spec:
+          {{- if $job.serviceAccount.enable }}
+          serviceAccountName: {{ $job.serviceAccount.name }}
+          {{- end }}
           containers:
           - name: {{ $job.name }}-backup-job
             image: {{ $.Values.dbBackupRestore.image.name }}:{{ $.Values.dbBackupRestore.image.tag }}
@@ -155,6 +158,19 @@ spec:
           nodeSelector:
             {{ $job.nodeSelector.label_key }} : {{ $job.nodeSelector.label_value }}
           {{- end }}
+          {{- if $job.nodeAffinity.enabled }}
+          affinity:
+            nodeAffinity:
+              requiredDuringSchedulingIgnoredDuringExecution:
+                nodeSelectorTerms:
+                  - matchExpressions:
+                      - key: {{ $job.nodeAffinity.key }}
+                        operator: In
+                        values:
+                        {{- range $job.nodeAffinity.values }}
+                          - {{ . | quote }}
+                        {{- end }}
+          {{- end }}
 ---
 {{- end }}
 {{- end }}
diff --git a/osm-seed/templates/jobs/changeset-replication-job-deployment.yaml b/osm-seed/templates/jobs/changeset-replication-job-deployment.yaml
@@ -18,6 +18,9 @@ spec:
       labels:
         app: {{ template "osm-seed.name" . }}
     spec:
+      {{- if .Values.changesetReplicationJob.serviceAccount.enable }}
+      serviceAccountName: {{ .Values.changesetReplicationJob.serviceAccount.name }}
+      {{- end }}
       containers:
         - name: {{ .Release.Name }}-changeset-replication-job-deployment
           image: {{ .Values.changesetReplicationJob.image.name }}:{{ .Values.changesetReplicationJob.image.tag }}
diff --git a/osm-seed/templates/jobs/full-history-job.yaml b/osm-seed/templates/jobs/full-history-job.yaml
@@ -19,6 +19,9 @@ spec:
       ttlSecondsAfterFinished: 300
       template:
         spec:
+          {{- if .Values.fullHistory.serviceAccount.enable }}
+          serviceAccountName: {{ .Values.fullHistory.serviceAccount.name }}
+          {{- end }}
           containers:
           - name: {{ .Release.Name }}-full-history-job
             image: {{ .Values.fullHistory.image.name }}:{{ .Values.fullHistory.image.tag }}
diff --git a/osm-seed/templates/jobs/osm-simple-metrics-job.yaml b/osm-seed/templates/jobs/osm-simple-metrics-job.yaml
@@ -19,6 +19,9 @@ spec:
       ttlSecondsAfterFinished: 300
       template:
         spec:
+          {{- if .Values.osmSimpleMetrics.serviceAccount.enable }}
+          serviceAccountName: {{ .Values.osmSimpleMetrics.serviceAccount.name }}
+          {{- end }}
           containers:
           - name: {{ .Release.Name }}-osm-simple-metrics-job
             image: {{ .Values.osmSimpleMetrics.image.name }}:{{ .Values.osmSimpleMetrics.image.tag }}
diff --git a/osm-seed/templates/jobs/planet-dump-job.yaml b/osm-seed/templates/jobs/planet-dump-job.yaml
@@ -19,6 +19,9 @@ spec:
       ttlSecondsAfterFinished: 300
       template:
         spec:
+          {{- if .Values.planetDump.serviceAccount.enable }}
+          serviceAccountName: {{ .Values.planetDump.serviceAccount.name }}
+          {{- end }}
           containers:
           - name: {{ .Release.Name }}-planet-dump-job
             image: {{ .Values.planetDump.image.name }}:{{ .Values.planetDump.image.tag }}
diff --git a/osm-seed/templates/jobs/populate-apidb-job.yaml b/osm-seed/templates/jobs/populate-apidb-job.yaml
@@ -11,6 +11,9 @@ metadata:
 spec:
     template:
       spec:
+        {{- if .Values.populateApidb.serviceAccount.enable }}
+        serviceAccountName: {{ .Values.populateApidb.serviceAccount.name }}
+        {{- end }}
         containers:
         - name: {{ .Release.Name }}-populate-apidb-job
           image: {{ .Values.populateApidb.image.name }}:{{ .Values.populateApidb.image.tag }}
diff --git a/osm-seed/templates/jobs/replication-job-deployment.yaml b/osm-seed/templates/jobs/replication-job-deployment.yaml
@@ -18,6 +18,9 @@ spec:
       labels:
         app: {{ template "osm-seed.name" . }}
     spec:
+      {{- if .Values.replicationJob.serviceAccount.enable }}
+      serviceAccountName: {{ .Values.replicationJob.serviceAccount.name }}
+      {{- end }}
       priorityClassName: {{ .Release.Name }}-{{ .Values.replicationJob.priorityClass | default "high-priority" }}
       containers:
         - name: {{ .Release.Name }}-replication-job-deployment
diff --git a/osm-seed/templates/jobs/replication-monitoring-job.yaml b/osm-seed/templates/jobs/replication-monitoring-job.yaml
@@ -19,6 +19,9 @@ spec:
       ttlSecondsAfterFinished: 60
       template:
         spec:
+          {{- if .Values.monitoringReplication.serviceAccount.enable }}
+          serviceAccountName: {{ .Values.monitoringReplication.serviceAccount.name }}
+          {{- end }}
           containers:
           - name: {{ .Release.Name }}-replication-monitoring-job
             image: {{ .Values.monitoringReplication.image.name }}:{{ .Values.monitoringReplication.image.tag }}
diff --git a/osm-seed/templates/taginfo/taginfo-deployment.yaml b/osm-seed/templates/taginfo/taginfo-deployment.yaml
@@ -22,6 +22,9 @@ spec:
         release: {{ .Release.Name }}
         run: {{ .Release.Name }}-taginfo-web
     spec:
+      {{- if .Values.taginfo.serviceAccount.enable }}
+      serviceAccountName: {{ .Values.taginfo.serviceAccount.name }}
+      {{- end }}
       priorityClassName: {{ .Release.Name }}-{{ .Values.taginfo.priorityClass | default "medium-priority" }}
       containers:
         - name: {{ .Chart.Name }}-taginfo
diff --git a/osm-seed/templates/tiler-imposm/tiler-imposm-statefulset.yaml b/osm-seed/templates/tiler-imposm/tiler-imposm-statefulset.yaml
@@ -19,6 +19,9 @@ spec:
       labels:
         app: {{ .Release.Name }}-tiler-imposm-sts
     spec:
+      {{- if .Values.tilerImposm.serviceAccount.enable }}
+      serviceAccountName: {{ .Values.tilerImposm.serviceAccount.name }}
+      {{- end }}
       priorityClassName: {{ .Release.Name }}-{{ .Values.tilerImposm.priorityClass | default "medium-priority" }}
       containers:
       - name: {{ .Release.Name }}-tiler-imposm-sts
diff --git a/osm-seed/templates/tiler-server/tiler-server-cache-cleaner-deployment.yaml b/osm-seed/templates/tiler-server/tiler-server-cache-cleaner-deployment.yaml
@@ -20,6 +20,9 @@ spec:
       labels:
         app: {{ template "osm-seed.name" . }}
     spec:
+      {{- if .Values.tilerServerCacheCleaner.serviceAccount.enable }}
+      serviceAccountName: {{ .Values.tilerServerCacheCleaner.serviceAccount.name }}
+      {{- end }}
       containers:
         - name: {{ .Release.Name }}-tiler-server-cache-cleaner-deployment
           image: {{ .Values.tilerServer.image.name }}:{{ .Values.tilerServer.image.tag }}
@@ -40,6 +43,20 @@ spec:
       nodeSelector:
         {{ .Values.tilerServerCacheCleaner.nodeSelector.label_key }} : {{ .Values.tilerServerCacheCleaner.nodeSelector.label_value }}
       {{- end }}
+      # Affinity settings
+      {{- if .Values.tilerServerCacheCleaner.nodeAffinity.enabled }}
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: {{ .Values.tilerServerCacheCleaner.nodeAffinity.key }}
+                    operator: In
+                    values:
+                    {{- range .Values.tilerServerCacheCleaner.nodeAffinity.values }}
+                      - {{ . | quote }}
+                    {{- end }}
+      {{- end }}
 {{- end }}
 {{- end }}
 {{- end }}
diff --git a/osm-seed/values.yaml b/osm-seed/values.yaml
@@ -148,9 +148,8 @@ web:
     name: ""
     tag: ""
   serviceAccount:
-    enabled: false
-    annotations:
-      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/osm-seed-web-s3-sqs-role
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "high-priority"
   replicaCount: 1
   ingressDomain: www.dev.osmseed.org
@@ -283,6 +282,9 @@ cgimap:
 fullHistory:
   enabled: false
   priorityClass: "low-priority"
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   image:
     name: ""
     tag: ""
@@ -320,6 +322,9 @@ dbBackupRestore:
     tag: "0.1.0-0.dev.git.942.h994af82"
   cronjobs:
     - name: web-db
+      serviceAccount:
+        enabled: true
+        name: ohm-web-s3-bucket-access-staging
       enabled: false
       schedule: "* * * * *"
       env:
@@ -353,6 +358,9 @@ dbBackupRestore:
         values: ["web"]
     - name: osmcha-db
       enabled: false
+      serviceAccount:
+        enabled: true
+        name: ohm-web-s3-bucket-access-staging
       schedule: "* * * * *"
       env:
         # DB action: backup/restore
@@ -388,9 +396,9 @@ dbBackupRestore:
 # ====================================================================================================
 planetDump:
   enabled: false
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "medium-priority"
   schedule: "* * * * *"
   env:
@@ -422,9 +430,9 @@ planetDump:
 # ====================================================================================================
 replicationJob:
   enabled: false
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "medium-priority"
   env:
     ENABLE_SEND_SLACK_MESSAGE: "false"
@@ -453,9 +461,9 @@ replicationJob:
 populateApidb:
   enabled: false
   priorityClass: "medium-priority"
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   env:
     URL_FILE_TO_IMPORT: "http://download.geofabrik.de/europe/monaco-latest.osm.pbf"
   resources:
@@ -579,9 +587,9 @@ tilerDb:
 # ====================================================================================================
 tilerImposm:
   enabled: false
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "medium-priority"
   env:
     TILER_IMPORT_FROM: osm
@@ -692,6 +700,9 @@ tilerServer:
 tilerServerCacheCleaner:
   enabled: false
   priorityClass: "medium-priority"
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   replicaCount: 1
   command: "./tile_cache_downloader.sh & ./expire-watcher.sh"
   resources:
@@ -973,9 +984,9 @@ overpassApi:
 # ====================================================================================================
 taginfo:
   enabled: false
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "medium-priority"
   serviceAnnotations: {}
   ingressDomain: taginfo-dev.staging.openhistoricalmap.org
@@ -1037,9 +1048,9 @@ taginfo:
 # ====================================================================================================
 osmSimpleMetrics:
   enabled: false
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "medium-priority"
   schedule: "* */1 * * *"
   resources:
@@ -1069,6 +1080,9 @@ monitoringReplication:
     name: "developmentseed/osmseed-replication-job"
     tag: "0.1.0-n770.hd15c9f2"
   priorityClass: "medium-priority"
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   schedule: "* */1 * * *"
   env:
     CREATE_MISSING_FILES: empty
@@ -1096,9 +1110,9 @@ monitoringReplication:
 # ====================================================================================================
 changesetReplicationJob:
   enabled: false
-  image:
-    name: ""
-    tag: ""
+  serviceAccount:
+    enabled: true
+    name: ohm-web-s3-bucket-access-staging
   priorityClass: "medium-priority"
   resources:
     enabled: false
