Always use dedicated service account in device-plugin helm chart

Signed-off-by: Christopher Desiniotis <cdesiniotis@nvidia.com>

Author: cdesiniotis

deployments/helm/nvidia-device-plugin/templates/daemonset-device-plugin.yml

@@ -15,7 +15,6 @@
 {{- if .Values.devicePlugin.enabled }}
 ---
 {{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- $useServiceAccount := $options.hasConfigMap }}
 {{- $configMapName := (include "nvidia-device-plugin.configMapName" .) | trim }}
 {{- $daemonsetName := printf "%s" (include "nvidia-device-plugin.fullname" .) | trunc 63 | trimSuffix "-" }}
 apiVersion: apps/v1
@@ -56,9 +55,7 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if $useServiceAccount }}
       serviceAccountName: {{ include "nvidia-device-plugin.fullname" . }}-service-account
-      {{- end }}
       {{- if $options.hasConfigMap }}
       shareProcessNamespace: true
       initContainers:

deployments/helm/nvidia-device-plugin/templates/daemonset-gfd.yml

@@ -15,7 +15,6 @@
 {{- if .Values.gfd.enabled }}
 ---
 {{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- $useServiceAccount := or $options.hasConfigMap .Values.gfd.enabled }}
 {{- $configMapName := (include "nvidia-device-plugin.configMapName" .) | trim }}
 {{- $daemonsetName := printf "%s-gpu-feature-discovery" (include "nvidia-device-plugin.fullname" .) | trunc 63 | trimSuffix "-" }}
 apiVersion: apps/v1
@@ -56,9 +55,7 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if $useServiceAccount }}
       serviceAccountName: {{ include "nvidia-device-plugin.fullname" . }}-service-account
-      {{- end }}
       {{- if $options.hasConfigMap }}
       shareProcessNamespace: true
       {{- end }}

deployments/helm/nvidia-device-plugin/templates/daemonset-mps-control-daemon.yml

@@ -54,12 +54,10 @@ spec:
       {{- end }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      {{- if $options.hasConfigMap }}
       serviceAccountName: {{ include "nvidia-device-plugin.fullname" . }}-service-account
       {{- if not .Values.mps.enableHostPID }}
       shareProcessNamespace: true
       {{- end }}
-      {{- end }}
       {{- if .Values.mps.enableHostPID }}
       hostPID: true
       {{- end }}

deployments/helm/nvidia-device-plugin/templates/role-binding.yml

@@ -1,6 +1,4 @@
 ---
-{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- if or $options.hasConfigMap .Values.gfd.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
@@ -15,4 +13,3 @@ roleRef:
   kind: ClusterRole
   name: {{ include "nvidia-device-plugin.fullname" . }}-role
   apiGroup: rbac.authorization.k8s.io
-{{- end }}

deployments/helm/nvidia-device-plugin/templates/role.yml

@@ -1,6 +1,4 @@
 ---
-{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- if or $options.hasConfigMap .Values.gfd.enabled }}
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
@@ -19,4 +17,3 @@ rules:
     resources: ["pods"]
     verbs: ["get"]
   {{- end }}
-{{- end }}

deployments/helm/nvidia-device-plugin/templates/service-account.yml

@@ -1,11 +1,8 @@
 ---
-{{- $options := (include "nvidia-device-plugin.options" . | fromJson) }}
-{{- if or $options.hasConfigMap .Values.gfd.enabled }}
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: {{ include "nvidia-device-plugin.fullname" . }}-service-account
   namespace: {{ include "nvidia-device-plugin.namespace" . }}
   labels:
     {{- include "nvidia-device-plugin.labels" . | nindent 4 }}
-{{- end }}