From eb3b63aef07c621d54f794cf2d7114a0972b6923 Mon Sep 17 00:00:00 2001 From: Martin Matyas Date: Fri, 16 Oct 2026 21:40:45 +0200 Subject: [PATCH] fix(nextcloud): run the pods as the chart's own service account by default The chart creates a service account only with rbac.enabled, which is off by default, so the Nextcloud pods run as the namespace's default service account. rbac.enabled binds the privileged PodSecurityPolicy, which Kubernetes removed in 1.25; the account itself has nothing to do with it. The service account is now created whenever rbac.serviceaccount.create is true (the default), whatever rbac.enabled says, and the Nextcloud Deployment and the cron CronJob always run as it. Its name defaults to the release's full name, so two releases in one namespace don't collide; a name set in rbac.serviceaccount.name is kept. With create set to false the pods run as the account named there, or as the namespace's default account when no name is given, as before. Installs that set rbac.enabled are unchanged: with no name set they keep nextcloud-serviceaccount, the previous default, whether the chart creates it or an existing one is used, so their account, and anything bound to its name outside the chart, stays as it is on upgrade. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Martin Matyas --- charts/nextcloud/Chart.yaml | 2 +- charts/nextcloud/README.md | 6 +++--- charts/nextcloud/templates/_helpers.tpl | 19 +++++++++++++++++++ charts/nextcloud/templates/cronjob.yaml | 4 +--- charts/nextcloud/templates/deployment.yaml | 4 +--- charts/nextcloud/templates/rbac.yaml | 2 +- .../nextcloud/templates/serviceaccount.yaml | 4 ++-- charts/nextcloud/values.yaml | 10 +++++++++- 8 files changed, 37 insertions(+), 14 deletions(-) diff --git a/charts/nextcloud/Chart.yaml b/charts/nextcloud/Chart.yaml index 25b717f2..9dc099bd 100644 --- a/charts/nextcloud/Chart.yaml +++ b/charts/nextcloud/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: nextcloud -version: 9.4.1 +version: 9.5.0 # renovate: image=docker.io/library/nextcloud appVersion: 35.0.2 description: A file sharing server that puts the control and security of your own data back into your hands. diff --git a/charts/nextcloud/README.md b/charts/nextcloud/README.md index bd94bb23..92b46b3f 100644 --- a/charts/nextcloud/README.md +++ b/charts/nextcloud/README.md @@ -241,9 +241,9 @@ The following table lists the configurable parameters of the nextcloud chart and | `phpClientHttpsFix.protocol` | Sets OVERWRITEPROTOCOL for https ingress redirect | `https` | | `resources` | CPU/Memory resource requests/limits | `{}` | | `priorityClassName` | Priority Class for pods | `nil` | -| `rbac.enabled` | Enable Role and rolebinding for priveledged PSP | `false` | -| `rbac.serviceaccount.create` | Wether to create a serviceaccount or use an existing one (requires rbac) | `true` | -| `rbac.serviceaccount.name` | The name of the sevice account that the deployment will use (requires rbac) | `nextcloud-serviceaccount` | +| `rbac.enabled` | Enable Role and rolebinding for priveledged PSP (removed in Kubernetes 1.25) | `false` | +| `rbac.serviceaccount.create` | Whether to create the serviceaccount the Nextcloud pods run as, or use an existing one | `true` | +| `rbac.serviceaccount.name` | Name of the serviceaccount; defaults to the release's full name (`nextcloud-serviceaccount` with `rbac.enabled`, as before), or to `default` when `create` is false | `""` | | `rbac.serviceaccount.annotations` | Serviceaccount annotations | `{}` | | `hpa.enabled` | Boolean to create a HorizontalPodAutoscaler. If set to `true`, ignores `replicaCount`. | `false` | | `hpa.cputhreshold` | CPU threshold percent for the HorizontalPodAutoscale | `60` | diff --git a/charts/nextcloud/templates/_helpers.tpl b/charts/nextcloud/templates/_helpers.tpl index 0b26c019..40596355 100644 --- a/charts/nextcloud/templates/_helpers.tpl +++ b/charts/nextcloud/templates/_helpers.tpl @@ -481,3 +481,22 @@ app.kubernetes.io/managed-by: {{ .rootContext.Release.Service }} app.kubernetes.io/version: {{ quote . }} {{- end }} {{- end -}} + +{{/* +The service account the Nextcloud pods run as: rbac.serviceaccount.name when +set; else nextcloud-serviceaccount when rbac.enabled is set, the previous +default, so installs that enabled rbac keep their account; else the release's +full name when the chart creates the account; else the namespace's default +account. +*/}} +{{- define "nextcloud.serviceAccountName" -}} +{{- if .Values.rbac.serviceaccount.name -}} +{{- .Values.rbac.serviceaccount.name -}} +{{- else if .Values.rbac.enabled -}} +nextcloud-serviceaccount +{{- else if .Values.rbac.serviceaccount.create -}} +{{- include "nextcloud.fullname" . -}} +{{- else -}} +default +{{- end -}} +{{- end -}} diff --git a/charts/nextcloud/templates/cronjob.yaml b/charts/nextcloud/templates/cronjob.yaml index b0fa7d74..6aa54130 100644 --- a/charts/nextcloud/templates/cronjob.yaml +++ b/charts/nextcloud/templates/cronjob.yaml @@ -135,9 +135,7 @@ spec: fsGroup: 33 {{- end }} {{- end }}{{/* end-with podSecurityContext */}} - {{- if .Values.rbac.enabled }} - serviceAccountName: {{ .Values.rbac.serviceaccount.name }} - {{- end }} + serviceAccountName: {{ include "nextcloud.serviceAccountName" $ }} {{- with .Values.dnsConfig }} dnsConfig: {{- toYaml . | nindent 12 }} diff --git a/charts/nextcloud/templates/deployment.yaml b/charts/nextcloud/templates/deployment.yaml index ab2ddc3e..41b550f0 100644 --- a/charts/nextcloud/templates/deployment.yaml +++ b/charts/nextcloud/templates/deployment.yaml @@ -425,9 +425,7 @@ spec: fsGroup: 33 {{- end }} {{- end }}{{/* end-with podSecurityContext */}} - {{- if .Values.rbac.enabled }} - serviceAccountName: {{ .Values.rbac.serviceaccount.name }} - {{- end }} + serviceAccountName: {{ include "nextcloud.serviceAccountName" . }} {{- with .Values.dnsConfig }} dnsConfig: {{- toYaml . | nindent 8 }} diff --git a/charts/nextcloud/templates/rbac.yaml b/charts/nextcloud/templates/rbac.yaml index e6b6a11a..09261bd8 100644 --- a/charts/nextcloud/templates/rbac.yaml +++ b/charts/nextcloud/templates/rbac.yaml @@ -26,6 +26,6 @@ roleRef: name: {{ template "nextcloud.fullname" . }}-privileged subjects: - kind: ServiceAccount - name: {{ .Values.rbac.serviceaccount.name }} + name: {{ include "nextcloud.serviceAccountName" . }} namespace: {{ .Release.Namespace }} {{- end }} diff --git a/charts/nextcloud/templates/serviceaccount.yaml b/charts/nextcloud/templates/serviceaccount.yaml index 84989dc0..9a98f8b1 100644 --- a/charts/nextcloud/templates/serviceaccount.yaml +++ b/charts/nextcloud/templates/serviceaccount.yaml @@ -1,9 +1,9 @@ -{{- if and .Values.rbac.enabled .Values.rbac.serviceaccount.create }} +{{- if .Values.rbac.serviceaccount.create }} --- apiVersion: v1 kind: ServiceAccount metadata: - name: {{ .Values.rbac.serviceaccount.name }} + name: {{ include "nextcloud.serviceAccountName" . }} {{- with .Values.rbac.serviceaccount.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/nextcloud/values.yaml b/charts/nextcloud/values.yaml index 860ad7ad..17ee7716 100644 --- a/charts/nextcloud/values.yaml +++ b/charts/nextcloud/values.yaml @@ -1098,10 +1098,18 @@ prometheus: additionalRules: [] rbac: + # Role and RoleBinding for the privileged PodSecurityPolicy (removed in Kubernetes 1.25) enabled: false + # The service account the Nextcloud pods run as, created by the chart by + # default so they don't share the namespace's default account serviceaccount: + # Create the service account; when false, the pods run as `name`, or as + # the namespace's default account if it is empty create: true - name: nextcloud-serviceaccount + # Defaults to the release's full name. Installs with rbac.enabled keep the + # previous default, nextcloud-serviceaccount, so their account does not + # change on upgrade + name: "" annotations: {} ## @param securityContext for nextcloud pod @deprecated Use `nextcloud.podSecurityContext` instead