fix(nextcloud): run the pods as the chart's own service account by default

charts/nextcloud/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: nextcloud
-version: 9.4.1
+version: 9.5.0
 # renovate: image=docker.io/library/nextcloud
 appVersion: 35.0.2
 description: A file sharing server that puts the control and security of your own data back into your hands.

charts/nextcloud/README.md

@@ -241,9 +241,9 @@ The following table lists the configurable parameters of the nextcloud chart and
 | `phpClientHttpsFix.protocol`                                | Sets OVERWRITEPROTOCOL for https ingress redirect                                                   | `https`                                                      |
 | `resources`                                                 | CPU/Memory resource requests/limits                                                                 | `{}`                                                         |
 | `priorityClassName`                                         | Priority Class for pods                                                                             | `nil`                                                        |
-| `rbac.enabled`                                              | Enable Role and rolebinding for priveledged PSP                                                     | `false`                                                      |
-| `rbac.serviceaccount.create`                                | Wether to create a serviceaccount or use an existing one (requires rbac)                            | `true`                                                       |
-| `rbac.serviceaccount.name`                                  | The name of the sevice account that the deployment will use (requires rbac)                         | `nextcloud-serviceaccount`                                   |
+| `rbac.enabled`                                              | Enable Role and rolebinding for priveledged PSP (removed in Kubernetes 1.25)                        | `false`                                                      |
+| `rbac.serviceaccount.create`                                | Whether to create the serviceaccount the Nextcloud pods run as, or use an existing one              | `true`                                                       |
+| `rbac.serviceaccount.name`                                  | Name of the serviceaccount; defaults to the release's full name (`nextcloud-serviceaccount` with `rbac.enabled`, as before), or to `default` when `create` is false | `""`                                                         |
 | `rbac.serviceaccount.annotations`                           | Serviceaccount annotations                                                                          | `{}`                                                         |
 | `hpa.enabled`                                               | Boolean to create a HorizontalPodAutoscaler. If set to `true`, ignores `replicaCount`.              | `false`                                                      |
 | `hpa.cputhreshold`                                          | CPU threshold percent for the HorizontalPodAutoscale                                                | `60`                                                         |

charts/nextcloud/templates/_helpers.tpl

@@ -481,3 +481,22 @@ app.kubernetes.io/managed-by: {{ .rootContext.Release.Service }}
 app.kubernetes.io/version: {{ quote . }}
 {{- end }}
 {{- end -}}
+
+{{/*
+The service account the Nextcloud pods run as: rbac.serviceaccount.name when
+set; else nextcloud-serviceaccount when rbac.enabled is set, the previous
+default, so installs that enabled rbac keep their account; else the release's
+full name when the chart creates the account; else the namespace's default
+account.
+*/}}
+{{- define "nextcloud.serviceAccountName" -}}
+{{- if .Values.rbac.serviceaccount.name -}}
+{{- .Values.rbac.serviceaccount.name -}}
+{{- else if .Values.rbac.enabled -}}
+nextcloud-serviceaccount
+{{- else if .Values.rbac.serviceaccount.create -}}
+{{- include "nextcloud.fullname" . -}}
+{{- else -}}
+default
+{{- end -}}
+{{- end -}}

charts/nextcloud/templates/cronjob.yaml

@@ -135,9 +135,7 @@ spec:
             fsGroup: 33
             {{- end }}
             {{- end }}{{/* end-with podSecurityContext */}}
-          {{- if .Values.rbac.enabled }}
-          serviceAccountName: {{ .Values.rbac.serviceaccount.name }}
-          {{- end }}
+          serviceAccountName: {{ include "nextcloud.serviceAccountName" $ }}
           {{- with .Values.dnsConfig }}
           dnsConfig:
             {{- toYaml . | nindent 12 }}

charts/nextcloud/templates/deployment.yaml

@@ -425,9 +425,7 @@ spec:
         fsGroup: 33
         {{- end }}
         {{- end }}{{/* end-with podSecurityContext */}}
-      {{- if .Values.rbac.enabled }}
-      serviceAccountName: {{ .Values.rbac.serviceaccount.name }}
-      {{- end }}
+      serviceAccountName: {{ include "nextcloud.serviceAccountName" . }}
       {{- with .Values.dnsConfig }}
       dnsConfig:
         {{- toYaml . | nindent 8 }}

charts/nextcloud/templates/rbac.yaml

@@ -26,6 +26,6 @@ roleRef:
   name: {{ template "nextcloud.fullname" . }}-privileged
 subjects:
   - kind: ServiceAccount
-    name: {{ .Values.rbac.serviceaccount.name }}
+    name: {{ include "nextcloud.serviceAccountName" . }}
     namespace: {{ .Release.Namespace }}
 {{- end }}

charts/nextcloud/templates/serviceaccount.yaml

@@ -1,9 +1,9 @@
-{{- if and .Values.rbac.enabled .Values.rbac.serviceaccount.create }}
+{{- if .Values.rbac.serviceaccount.create }}
 ---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.rbac.serviceaccount.name }}
+  name: {{ include "nextcloud.serviceAccountName" . }}
   {{- with .Values.rbac.serviceaccount.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}

charts/nextcloud/values.yaml

@@ -1098,10 +1098,18 @@ prometheus:
     additionalRules: []
 
 rbac:
+  # Role and RoleBinding for the privileged PodSecurityPolicy (removed in Kubernetes 1.25)
   enabled: false
+  # The service account the Nextcloud pods run as, created by the chart by
+  # default so they don't share the namespace's default account
   serviceaccount:
+    # Create the service account; when false, the pods run as `name`, or as
+    # the namespace's default account if it is empty
     create: true
-    name: nextcloud-serviceaccount
+    # Defaults to the release's full name. Installs with rbac.enabled keep the
+    # previous default, nextcloud-serviceaccount, so their account does not
+    # change on upgrade
+    name: ""
     annotations: {}
 
 ## @param securityContext for nextcloud pod @deprecated Use `nextcloud.podSecurityContext` instead