Merge pull request #50 from huang-jy/master

Enable ServiceAccount annotations

moon/templates/moon.yaml

@@ -4,6 +4,12 @@ kind: ServiceAccount
 metadata:
   name: {{ .Release.Name }}
   namespace: {{ .Release.Namespace }}
+  {{- if and .Values.moon.serviceaccount .Values.moon.serviceaccount.annotations }}
+  annotations:
+  {{- range $key, $value := .Values.moon.serviceaccount.annotations }}
+    {{ $key }}: {{ $value | quote }}
+  {{- end }}
+  {{- end }}
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role

moon/values.yaml

@@ -6,6 +6,14 @@ moon:
   enabled:
     resources: true
 
+  ##
+  ## Optionally add annotations to the service account generated byt the chart
+  ## This is necessary if you intend to use the moon service account for
+  ## Workload Identity or want to tag it for any security monitoring tools
+  ##
+  serviceaccount:
+    annotations: {}
+      # iam.gke.io/gcp-service-account: [email protected]
 #  ##
 #  ## Global timeouts.
 #  ##