From 566d2a1eacc652e57432e44479c2ad2bfd8a0203 Mon Sep 17 00:00:00 2001 From: Martin Matyas Date: Fri, 16 Oct 2026 21:40:45 +0200 Subject: [PATCH] fix(nextcloud): run the pods as the chart's own service account by default The chart creates a service account only with rbac.enabled, which is off by default, so the Nextcloud pods run as the namespace's default service account. rbac.enabled binds the privileged PodSecurityPolicy, which Kubernetes removed in 1.25; the account itself has nothing to do with it. The service account is now created whenever rbac.serviceaccount.create is true (the default), whatever rbac.enabled says, and the Nextcloud Deployment and the cron CronJob always run as it. Its name defaults to the release's full name, as the chart's other objects are named, so two releases in one namespace don't collide; a name set in rbac.serviceaccount.name is kept. With create set to false the pods run as the account named there, or as the namespace's default account when no name is given, as before. Installs that set rbac.enabled without a name used nextcloud-serviceaccount, the previous default of rbac.serviceaccount.name. They now get the release's full name too: the chart creates that account and moves its RoleBinding to it, and the pods roll out once on upgrade. To keep the old account, set rbac.serviceaccount.name: nextcloud-serviceaccount; with create set to false that is required, as for any existing account. Co-Authored-By: Claude Opus 5.5 Signed-off-by: Martin Matyas --- charts/nextcloud/Chart.yaml | 2 +- charts/nextcloud/README.md | 6 +++--- charts/nextcloud/templates/_helpers.tpl | 17 +++++++++++++++++ charts/nextcloud/templates/cronjob.yaml | 4 +--- charts/nextcloud/templates/deployment.yaml | 4 +--- charts/nextcloud/templates/rbac.yaml | 2 +- charts/nextcloud/templates/serviceaccount.yaml | 4 ++-- charts/nextcloud/values.yaml | 9 ++++++++- 8 files changed, 34 insertions(+), 14 deletions(-) diff --git a/charts/nextcloud/Chart.yaml b/charts/nextcloud/Chart.yaml index 5a24555a..9dc099bd 100644 --- a/charts/nextcloud/Chart.yaml +++ b/charts/nextcloud/Chart.yaml @@ -1,6 +1,6 @@ apiVersion: v2 name: nextcloud -version: 9.4.3 +version: 9.5.0 # renovate: image=docker.io/library/nextcloud appVersion: 35.0.2 description: A file sharing server that puts the control and security of your own data back into your hands. diff --git a/charts/nextcloud/README.md b/charts/nextcloud/README.md index 418e0069..edbb44f0 100644 --- a/charts/nextcloud/README.md +++ b/charts/nextcloud/README.md @@ -240,9 +240,9 @@ The following table lists the configurable parameters of the nextcloud chart and | `phpClientHttpsFix.protocol` | Sets OVERWRITEPROTOCOL for https ingress redirect | `https` | | `resources` | CPU/Memory resource requests/limits | `{}` | | `priorityClassName` | Priority Class for pods | `nil` | -| `rbac.enabled` | Enable Role and rolebinding for priveledged PSP | `false` | -| `rbac.serviceaccount.create` | Wether to create a serviceaccount or use an existing one (requires rbac) | `true` | -| `rbac.serviceaccount.name` | The name of the sevice account that the deployment will use (requires rbac) | `nextcloud-serviceaccount` | +| `rbac.enabled` | Enable Role and rolebinding for priveledged PSP (removed in Kubernetes 1.25) | `false` | +| `rbac.serviceaccount.create` | Whether to create the serviceaccount the Nextcloud pods run as, or use an existing one | `true` | +| `rbac.serviceaccount.name` | Name of the serviceaccount; defaults to the release's full name, or to `default` when `create` is false | `""` | | `rbac.serviceaccount.annotations` | Serviceaccount annotations | `{}` | | `hpa.enabled` | Boolean to create a HorizontalPodAutoscaler. If set to `true`, ignores `replicaCount`. | `false` | | `hpa.cputhreshold` | CPU threshold percent for the HorizontalPodAutoscale | `60` | diff --git a/charts/nextcloud/templates/_helpers.tpl b/charts/nextcloud/templates/_helpers.tpl index 0b26c019..b9fdc103 100644 --- a/charts/nextcloud/templates/_helpers.tpl +++ b/charts/nextcloud/templates/_helpers.tpl @@ -481,3 +481,20 @@ app.kubernetes.io/managed-by: {{ .rootContext.Release.Service }} app.kubernetes.io/version: {{ quote . }} {{- end }} {{- end -}} + +{{/* +The service account the Nextcloud pods run as: rbac.serviceaccount.name when +set; else the release's full name when the chart creates the account; else +the namespace's default account. +*/}} +{{- define "nextcloud.serviceAccountName" -}} +{{- with .Values.rbac.serviceaccount.name -}} +{{- . -}} +{{- else -}} +{{- if .Values.rbac.serviceaccount.create -}} +{{- include "nextcloud.fullname" . -}} +{{- else -}} +default +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/nextcloud/templates/cronjob.yaml b/charts/nextcloud/templates/cronjob.yaml index b0fa7d74..6aa54130 100644 --- a/charts/nextcloud/templates/cronjob.yaml +++ b/charts/nextcloud/templates/cronjob.yaml @@ -135,9 +135,7 @@ spec: fsGroup: 33 {{- end }} {{- end }}{{/* end-with podSecurityContext */}} - {{- if .Values.rbac.enabled }} - serviceAccountName: {{ .Values.rbac.serviceaccount.name }} - {{- end }} + serviceAccountName: {{ include "nextcloud.serviceAccountName" $ }} {{- with .Values.dnsConfig }} dnsConfig: {{- toYaml . | nindent 12 }} diff --git a/charts/nextcloud/templates/deployment.yaml b/charts/nextcloud/templates/deployment.yaml index ab2ddc3e..41b550f0 100644 --- a/charts/nextcloud/templates/deployment.yaml +++ b/charts/nextcloud/templates/deployment.yaml @@ -425,9 +425,7 @@ spec: fsGroup: 33 {{- end }} {{- end }}{{/* end-with podSecurityContext */}} - {{- if .Values.rbac.enabled }} - serviceAccountName: {{ .Values.rbac.serviceaccount.name }} - {{- end }} + serviceAccountName: {{ include "nextcloud.serviceAccountName" . }} {{- with .Values.dnsConfig }} dnsConfig: {{- toYaml . | nindent 8 }} diff --git a/charts/nextcloud/templates/rbac.yaml b/charts/nextcloud/templates/rbac.yaml index e6b6a11a..09261bd8 100644 --- a/charts/nextcloud/templates/rbac.yaml +++ b/charts/nextcloud/templates/rbac.yaml @@ -26,6 +26,6 @@ roleRef: name: {{ template "nextcloud.fullname" . }}-privileged subjects: - kind: ServiceAccount - name: {{ .Values.rbac.serviceaccount.name }} + name: {{ include "nextcloud.serviceAccountName" . }} namespace: {{ .Release.Namespace }} {{- end }} diff --git a/charts/nextcloud/templates/serviceaccount.yaml b/charts/nextcloud/templates/serviceaccount.yaml index 84989dc0..9a98f8b1 100644 --- a/charts/nextcloud/templates/serviceaccount.yaml +++ b/charts/nextcloud/templates/serviceaccount.yaml @@ -1,9 +1,9 @@ -{{- if and .Values.rbac.enabled .Values.rbac.serviceaccount.create }} +{{- if .Values.rbac.serviceaccount.create }} --- apiVersion: v1 kind: ServiceAccount metadata: - name: {{ .Values.rbac.serviceaccount.name }} + name: {{ include "nextcloud.serviceAccountName" . }} {{- with .Values.rbac.serviceaccount.annotations }} annotations: {{- toYaml . | nindent 4 }} diff --git a/charts/nextcloud/values.yaml b/charts/nextcloud/values.yaml index a0367120..47d57f1d 100644 --- a/charts/nextcloud/values.yaml +++ b/charts/nextcloud/values.yaml @@ -1098,10 +1098,17 @@ prometheus: additionalRules: [] rbac: + # Role and RoleBinding for the privileged PodSecurityPolicy (removed in Kubernetes 1.25) enabled: false + # The service account the Nextcloud pods run as, created by the chart by + # default so they don't share the namespace's default account serviceaccount: + # Create the service account; when false, the pods run as `name`, or as + # the namespace's default account if it is empty create: true - name: nextcloud-serviceaccount + # Defaults to the release's full name, as the chart's other objects are + # named, so two releases in one namespace don't collide + name: "" annotations: {} ## @param securityContext for nextcloud pod @deprecated Use `nextcloud.podSecurityContext` instead