chore: scaffold benchmark workload namespace and RBAC

charts/plugin-bench/templates/_helpers.tpl

@@ -17,6 +17,31 @@
 {{- end }}
 {{- end }}
 
+{{/* Namespace for benchmark workload resources. */}}
+{{- define "plugin-bench.workloadNamespace" -}}
+{{- default .Release.Namespace .Values.workload.namespace -}}
+{{- end }}
+
+{{/* ServiceAccount used by the coordinator deployment. */}}
+{{- define "plugin-bench.coordinatorServiceAccountName" -}}
+{{- printf "%s-coordinator" (include "plugin-bench.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{/* ServiceAccount used by future benchmark Jobs. */}}
+{{- define "plugin-bench.runnerServiceAccountName" -}}
+{{- printf "%s-runner" (include "plugin-bench.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{/* Role used by the coordinator for benchmark workloads. */}}
+{{- define "plugin-bench.workloadRoleName" -}}
+{{- printf "%s-workload" (include "plugin-bench.fullname" .) | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
+{{/* RoleBinding used to grant the coordinator workload permissions. */}}
+{{- define "plugin-bench.workloadRoleBindingName" -}}
+{{- printf "%s-binding" (include "plugin-bench.workloadRoleName" .) | trunc 63 | trimSuffix "-" -}}
+{{- end }}
+
 {{/* Chart label. */}}
 {{- define "plugin-bench.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}

charts/plugin-bench/templates/deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: {{ include "plugin-bench.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace | quote }}
   labels:
     {{- include "plugin-bench.labels" . | nindent 4 }}
 spec:
@@ -15,6 +15,7 @@ spec:
       labels:
         {{- include "plugin-bench.selectorLabels" . | nindent 8 }}
     spec:
+      serviceAccountName: {{ include "plugin-bench.coordinatorServiceAccountName" . }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -29,6 +30,10 @@ spec:
           env:
             - name: PORT
               value: {{ .Values.service.port | quote }}
+            - name: WORKLOAD_NAMESPACE
+              value: {{ include "plugin-bench.workloadNamespace" . | quote }}
+            - name: RUNNER_SERVICE_ACCOUNT_NAME
+              value: {{ include "plugin-bench.runnerServiceAccountName" . | quote }}
             {{- if .Values.everestAPIURL }}
             - name: EVEREST_API_URL
               value: {{ .Values.everestAPIURL | quote }}

charts/plugin-bench/templates/plugin-cr.yaml

@@ -10,7 +10,7 @@ spec:
   enabled: {{ .Values.plugin.enabled }}
   backend:
     serviceRef:
-      namespace: {{ .Release.Namespace }}
+      namespace: {{ .Release.Namespace | quote }}
       name: {{ include "plugin-bench.fullname" . }}
       port: {{ .Values.service.port }}
   frontend:

charts/plugin-bench/templates/role.yaml

@@ -0,0 +1,20 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: {{ include "plugin-bench.workloadRoleName" . }}
+  namespace: {{ include "plugin-bench.workloadNamespace" . | quote }}
+  labels:
+    {{- include "plugin-bench.labels" . | nindent 4 }}
+rules:
+  - apiGroups: ["batch"]
+    resources: ["jobs"]
+    verbs: ["create", "get", "list", "watch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "watch"]
+  - apiGroups: [""]
+    resources: ["pods/log"]
+    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["create", "get", "delete"]

charts/plugin-bench/templates/rolebinding.yaml

@@ -0,0 +1,15 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: {{ include "plugin-bench.workloadRoleBindingName" . }}
+  namespace: {{ include "plugin-bench.workloadNamespace" . | quote }}
+  labels:
+    {{- include "plugin-bench.labels" . | nindent 4 }}
+subjects:
+  - kind: ServiceAccount
+    name: {{ include "plugin-bench.coordinatorServiceAccountName" . }}
+    namespace: {{ .Release.Namespace | quote }}
+roleRef:
+  kind: Role
+  name: {{ include "plugin-bench.workloadRoleName" . }}
+  apiGroup: rbac.authorization.k8s.io

charts/plugin-bench/templates/service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: {{ include "plugin-bench.fullname" . }}
-  namespace: {{ .Release.Namespace }}
+  namespace: {{ .Release.Namespace | quote }}
   labels:
     {{- include "plugin-bench.labels" . | nindent 4 }}
 spec:

charts/plugin-bench/templates/serviceaccount.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "plugin-bench.coordinatorServiceAccountName" . }}
+  namespace: {{ .Release.Namespace | quote }}
+  labels:
+    {{- include "plugin-bench.labels" . | nindent 4 }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "plugin-bench.runnerServiceAccountName" . }}
+  namespace: {{ include "plugin-bench.workloadNamespace" . | quote }}
+  labels:
+    {{- include "plugin-bench.labels" . | nindent 4 }}
+automountServiceAccountToken: false

charts/plugin-bench/templates/workload-namespace.yaml

@@ -0,0 +1,10 @@
+{{- if and .Values.workload.createNamespace .Values.workload.namespace (ne .Values.workload.namespace .Release.Namespace) }}
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: {{ include "plugin-bench.workloadNamespace" . | quote }}
+  labels:
+    {{- include "plugin-bench.labels" . | nindent 4 }}
+  annotations:
+    helm.sh/resource-policy: keep
+{{- end }}

charts/plugin-bench/values.yaml

@@ -31,6 +31,14 @@ plugin:
 
 everestAPIURL: ""
 
+# Namespace used for benchmark Jobs and their temporary resources.
+# An empty value uses the Helm release namespace.
+workload:
+  namespace: ""
+  # Set to true only when the Helm installer is allowed to create the
+  # configured workload namespace.
+  createNamespace: false
+
 resources:
   limits:
     cpu: 200m