fix(argo-cd): create service account for repo server by default

[eddycharly]

This PR enables the creation of a service account for repo server by default.

[mbevc1]

Thanks, seems this would align this to other charts. Could you please provide changelog infor as well?

[eddycharly]

@mbevc1 sure, how shall I provide the changelog ?

[mbevc1]

There is an annotation that is used, i.e. https://github.com/argoproj/argo-helm/blob/master/charts/argo-cd/Chart.yaml#L22-L24

[mbevc1]

Thanks! Mind you need to replace current one as artifacthub is appending it automatically.

[eddycharly]

Done, do I need to bump the chart version ?
I guess i will have to regen the docs too.

[mbevc1]

Yes, please. Version needs bumping as well. Docs should be fine unless there are any changes related to those.

[eddycharly]

@mbevc1 version bumped and docs up to date.

[mbevc1]

Looks good, just before merging thinking if we should bump minor version as this changes current default 🤔
Thoughts @mkilchhofer @davidkarlsen @yann-soubeyrand ?

[mkilchhofer]

I wanted to ask for the use case? :-)

The upstream manifest (which are our template) do not create a ServiceAccount for the repo-server. Also the server does not have a mounted service account token by default

Ref:

• https://github.com/argoproj/argo-cd/blob/v2.2.5/manifests/base/repo-server/argocd-repo-server-deployment.yaml#L18
• https://github.com/argoproj/argo-cd/tree/v2.2.5/manifests/base/repo-server

[eddycharly]

@mkilchhofer the use case is to identify to allow usage of CiliumNetworkPolicy with rules based on service accounts.

[eddycharly]

IMHO it shouldn't hurt to have a service account. Even if you don't specify one it will fallback to use default.
TBH, i don't see any case where it's not advisable to create one.

[mkilchhofer]

@mkilchhofer the use case is to identify to allow usage of CiliumNetworkPolicy with rules based on service accounts.

Okay. This is a valable use case, I also override to true as I use helm plugins talking to the kube-api.

But it still is not comply in these two ideas:

• charts README

  The default installation is intended to be similar to the provided ArgoCD releases.

• least privilege principle (okay to be fair, the default SA normally also has kube-api access)

Idk, I am okay if we proceed and merge as it is such a small change ;)

[eddycharly]

Idk, I am okay if we proceed and merge as it is such a small change ;)

Let's do that ;)