chore: Align settings to SaaS (#204)

* chore(ingress): Rename ingress.protocol to schema * chore(config-map): Add SOCIAL_AUTH_ALLOWED_REDIRECT_HOSTS based on host * feat(serviceaccount): Add service accounts to workers * chore(webhooks): Remove unused webhook variables * fix(dvcx): Fix formatting `true` -> `True` and `false` -> `False` * Fix default service account names * feat(ui): Add startup probe to ui pod * fix(service account): Add sa to backend * Bump Chart.yaml * Add dvcx-worker livenessProbe * Helm-Docs update --------- Co-authored-by: Marcin Jasion <[email protected]> Co-authored-by: Jesper Svendsen <[email protected]>
iterative · Oct 6, 2023 · 9aaf1ef · 9aaf1ef
1 parent ca43eb1
commit 9aaf1ef
Show file tree

Hide file tree

Showing 14 changed files with 121 additions and 40 deletions.
diff --git a/charts/studio/Chart.yaml b/charts/studio/Chart.yaml
@@ -2,8 +2,8 @@ apiVersion: v2
 name: studio
 description: A Helm chart for Kubernetes
 type: application
-version: 0.6.7
-appVersion: "v2.29.0"
+version: 0.7.0
+appVersion: "v2.40.0"
 maintainers:
   - name: iterative
     email: [email protected]

diff --git a/charts/studio/README.md b/charts/studio/README.md
@@ -1,6 +1,6 @@
 # studio
 
-![Version: 0.6.7](https://img.shields.io/badge/Version-0.6.7-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.29.0](https://img.shields.io/badge/AppVersion-v2.29.0-informational?style=flat-square)
+![Version: 0.7.0](https://img.shields.io/badge/Version-0.7.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.40.0](https://img.shields.io/badge/AppVersion-v2.40.0-informational?style=flat-square)
 
 A Helm chart for Kubernetes
 
@@ -56,14 +56,13 @@ A Helm chart for Kubernetes
 | global.postgres.password | string | `"postgres"` | Postgres password |
 | global.postgres.port | string | `"5432"` | Postgres port |
 | global.postgres.user | string | `"postgres"` | Postgres user |
-| global.scmProviders.bitbucket | object | `{"apiUrl":"","clientId":"","enabled":false,"secretKey":"","url":"","webhookUrl":""}` | BitBucket App integration with Studio. |
+| global.scmProviders.bitbucket | object | `{"apiUrl":"","clientId":"","enabled":false,"secretKey":"","url":""}` | BitBucket App integration with Studio. |
 | global.scmProviders.bitbucket.apiUrl | string | `""` | Bitbucket Server API URL Set this if you're using the selfhosted version |
 | global.scmProviders.bitbucket.clientId | string | `""` | Bitbucket OAuth App Client ID |
 | global.scmProviders.bitbucket.enabled | bool | `false` | Bitbucket enabled |
 | global.scmProviders.bitbucket.secretKey | string | `""` | Bitbucket OAuth App Secret Key |
 | global.scmProviders.bitbucket.url | string | `""` | Bitbucket Server URL Set this if you're using the selfhosted version |
-| global.scmProviders.bitbucket.webhookUrl | DEPRECATED | `""` | BitBucket Webhook URL |
-| global.scmProviders.github | object | `{"apiUrl":"","appId":"","appName":"","clientId":"","clientSecret":"","enabled":false,"privateKey":"","url":"","webhookUrl":""}` | GitHub App integration with Studio. |
+| global.scmProviders.github | object | `{"apiUrl":"","appId":"","appName":"","clientId":"","clientSecret":"","enabled":false,"privateKey":"","url":""}` | GitHub App integration with Studio. |
 | global.scmProviders.github.apiUrl | string | `""` | GitHub Enterprise API URL Set this if you're using the selfhosted version |
 | global.scmProviders.github.appId | string | `""` | GitHub OAuth App ID |
 | global.scmProviders.github.appName | string | `""` | GitHub OAuth App Name |
@@ -72,14 +71,12 @@ A Helm chart for Kubernetes
 | global.scmProviders.github.enabled | bool | `false` | GitHub enabled |
 | global.scmProviders.github.privateKey | string | `""` | GitHub OAuth App Private Key |
 | global.scmProviders.github.url | string | `""` | GitHub Enterprise URL Set this if you're using the selfhosted version |
-| global.scmProviders.github.webhookUrl | DEPRECATED | `""` | GitHub Webhook URL |
-| global.scmProviders.gitlab | object | `{"clientId":"","enabled":false,"secretKey":"","url":"","webhookSecret":"","webhookUrl":""}` | GitLab App integration with Studio. |
+| global.scmProviders.gitlab | object | `{"clientId":"","enabled":false,"secretKey":"","url":"","webhookSecret":""}` | GitLab App integration with Studio. |
 | global.scmProviders.gitlab.clientId | string | `""` | GitLab OAuth App Client ID |
 | global.scmProviders.gitlab.enabled | bool | `false` | GitLab enabled |
 | global.scmProviders.gitlab.secretKey | string | `""` | GitLab OAuth App Secret Key |
 | global.scmProviders.gitlab.url | string | `""` | GitLab Enterprise Edition URL Set this if you're using the selfhosted version |
 | global.scmProviders.gitlab.webhookSecret | string | `""` | GitLab Webhook Secret |
-| global.scmProviders.gitlab.webhookUrl | DEPRECATED | `""` | GitLab Webhook URL |
 | global.scmProviders.webhookHost | string | `$global.host` value. | Custom hostname for incoming webhook (if Studio runs on a private network and you use SaaS versions of GitHub, GitLab, or Bitbucket) |
 | global.secretKey | string | `""` | Studio: Secret key for signing Webhook payloads We recommend you set this externally. If left empty, a random key will be generated. |
 | imagePullSecrets | list | `[]` | Secret containing Docker registry credentials |
@@ -139,7 +136,7 @@ A Helm chart for Kubernetes
 | studioBlobvault.image | object | `{"repository":"nginx","tag":"1.25.1-alpine"}` | Image to use for the blobvault service |
 | studioBlobvault.image.repository | string | `"nginx"` | Image repository |
 | studioBlobvault.image.tag | string | `"1.25.1-alpine"` | Image tag |
-| studioDvcxWorker | object | `{"affinity":{},"autoscaling":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80},"envFromSecret":"","envVars":{},"ephemeralStorage":{"persistentVolumeClaim":{"storageClass":""},"size":"1Gi","type":"emptyDir"},"image":{"pullPolicy":"IfNotPresent","repository":"docker.iterative.ai/studio-dvcx-worker"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"replicaCount":1,"resources":{"limits":{"cpu":"8000m","ephemeral-storage":"10Gi","memory":"16Gi"},"requests":{"cpu":"500m","ephemeral-storage":"500Mi","memory":"512Mi"}},"securityContext":{},"strategy":{"rollingUpdate":{"maxSurge":"50%","maxUnavailable":0}},"tolerations":[]}` | Studio DVCx Worker settings group |
+| studioDvcxWorker | object | `{"affinity":{},"autoscaling":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80},"envFromSecret":"","envVars":{},"ephemeralStorage":{"persistentVolumeClaim":{"storageClass":""},"size":"1Gi","type":"emptyDir"},"image":{"pullPolicy":"IfNotPresent","repository":"docker.iterative.ai/studio-dvcx-worker"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"replicaCount":1,"resources":{"limits":{"cpu":"8000m","ephemeral-storage":"10Gi","memory":"16Gi"},"requests":{"cpu":"500m","ephemeral-storage":"500Mi","memory":"512Mi"}},"securityContext":{},"serviceAccount":{"annotations":{},"create":false,"name":""},"strategy":{"rollingUpdate":{"maxSurge":"50%","maxUnavailable":0}},"tolerations":[]}` | Studio DVCx Worker settings group |
 | studioDvcxWorker.affinity | object | `{}` | DVCx worker pod affinity configuration |
 | studioDvcxWorker.autoscaling | object | `{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80}` | DVCx worker autoscaling configuration |
 | studioDvcxWorker.autoscaling.enabled | bool | `false` | DVCx worker autoscaling enabled flag |
@@ -188,7 +185,7 @@ A Helm chart for Kubernetes
 | studioUi | object | `{"affinity":{},"autoscaling":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80},"envFromSecret":"","envVars":{},"image":{"pullPolicy":"IfNotPresent","repository":"docker.iterative.ai/studio-frontend"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"replicaCount":1,"resources":{"limits":{"cpu":"1000m","memory":"2Gi"},"requests":{"cpu":"500m","memory":"1Gi"}},"securityContext":{},"service":{"port":3000,"type":"ClusterIP"},"strategy":{"rollingUpdate":{"maxSurge":"50%","maxUnavailable":0}},"tolerations":[]}` | Studio UI settings group |
 | studioUi.envFromSecret | string | `""` | The name of an existing Secret that contains sensitive environment variables passed to UI pods. |
 | studioUi.envVars | object | `{}` | Additional environment variables for ui pods |
-| studioWorker | object | `{"affinity":{},"autoscaling":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80},"envFromSecret":"","envVars":{},"image":{"pullPolicy":"IfNotPresent","repository":"docker.iterative.ai/studio-backend"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"replicaCount":1,"resources":{"limits":{"cpu":"1000m","memory":"1Gi"},"requests":{"cpu":"500m","memory":"512Mi"}},"securityContext":{},"strategy":{"rollingUpdate":{"maxSurge":"50%","maxUnavailable":0}},"tolerations":[]}` | Studio worker settings group |
+| studioWorker | object | `{"affinity":{},"autoscaling":{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80},"envFromSecret":"","envVars":{},"image":{"pullPolicy":"IfNotPresent","repository":"docker.iterative.ai/studio-backend"},"nodeSelector":{},"podAnnotations":{},"podSecurityContext":{},"replicaCount":1,"resources":{"limits":{"cpu":"1000m","memory":"1Gi"},"requests":{"cpu":"500m","memory":"512Mi"}},"securityContext":{},"serviceAccount":{"annotations":{},"create":false,"name":""},"strategy":{"rollingUpdate":{"maxSurge":"50%","maxUnavailable":0}},"tolerations":[]}` | Studio worker settings group |
 | studioWorker.affinity | object | `{}` | Worker affinity |
 | studioWorker.autoscaling | object | `{"enabled":false,"maxReplicas":5,"minReplicas":1,"targetCPUUtilizationPercentage":80}` | Worker autoscaling configuration |
 | studioWorker.autoscaling.enabled | bool | `false` | Worker autoscaling enabled flag |

diff --git a/charts/studio/templates/NOTES.txt b/charts/studio/templates/NOTES.txt
@@ -1,6 +1,6 @@
 Application URL:
 {{- if .Values.global.ingress.enabled }}
-  {{include "ingress.protocol" . }}://{{.Values.global.host }}/{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}{{ include "studio.basePath" . }}{{- end }}
+  {{ include "scheme" . }}://{{.Values.global.host }}/{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}{{ include "studio.basePath" . }}{{- end }}
 {{- else if contains "NodePort" .Values.studioUi.service.type }}
 Get the application URL by running these commands:
   export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "studio.fullname" . }})

diff --git a/charts/studio/templates/_helpers.tpl b/charts/studio/templates/_helpers.tpl
@@ -176,6 +176,30 @@ Create the name of the service account to use
 {{- end }}
 {{- end }}
 
+{{- define "studio-backend.serviceAccountName" -}}
+{{- if ((.Values.studioBackend).serviceAccount).create }}
+{{- default (printf "%s%s" (include "studio.fullname" .) "-backend") .Values.studioWorker.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.studioWorker.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "studio-worker.serviceAccountName" -}}
+{{- if ((.Values.studioWorker).serviceAccount).create }}
+{{- default (printf "%s%s" (include "studio.fullname" .) "-worker") .Values.studioWorker.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.studioWorker.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{- define "studio-dvcx-worker.serviceAccountName" -}}
+{{- if ((.Values.studioDvcxWorker).serviceAccount).create }}
+{{- default (printf "%s%s" (include "studio.fullname" .) "-dvcx-worker") .Values.studioDvcxWorker.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.studioDvcxWorker.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
 {{- define "studio.checksum" }}
 checksum/configmap-studio: {{ include (print $.Template.BasePath "/configmap-studio.yaml") . | sha256sum }}
 checksum/configmap-ca-cert: {{ include (print $.Template.BasePath "/configmap-ca-cert.yaml") . | sha256sum }}
@@ -191,6 +215,6 @@ checksum/secret-studio: {{ include (print $.Template.BasePath "/secret-studio.ya
 {{- printf "{\"auths\": {\"%s\": {\"auth\": \"%s\"}}}" .Values.dockerServer (printf "%s:%s" .Values.dockerUsername .Values.dockerPassword | b64enc) }}
 {{- end }}
 
-{{- define "ingress.protocol" -}}
-http{{- if $.Values.global.ingress.tlsEnabled }}s{{- end}}
+{{- define "scheme" -}}
+http{{- if $.Values.global.ingress.tlsEnabled }}s{{- end }}
 {{- end }}
diff --git a/charts/studio/templates/configmap-studio.yaml b/charts/studio/templates/configmap-studio.yaml
@@ -9,8 +9,8 @@ data:
 {{- end }}
 
   ALLOWED_HOSTS: "*"
-  API_URL: "{{include "ingress.protocol" . }}://{{.Values.global.host }}{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}/{{ include "studio.basePath" . }}{{- end }}/api"
-  UI_URL: "{{include "ingress.protocol" . }}://{{.Values.global.host }}/{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}{{ include "studio.basePath" . }}{{- end }}"
+  API_URL: "{{ include "scheme" . }}://{{.Values.global.host }}{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}/{{ include "studio.basePath" . }}{{- end }}/api"
+  UI_URL: "{{ include "scheme" . }}://{{.Values.global.host }}/{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}{{ include "studio.basePath" . }}{{- end }}"
 
   {{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}
   BASE_PATH: /{{ include "studio.basePath" . }}
@@ -26,7 +26,7 @@ data:
   BITBUCKET_API_URL: {{ .Values.global.scmProviders.bitbucket.apiUrl | quote}}
   {{- end }}
   {{- if and .Values.global.scmProviders.bitbucket.enabled $webhookHost }}
-  BITBUCKET_WEBHOOK_URL: "{{include "ingress.protocol" . }}://{{ $webhookHost }}/webhook/bitbucket/"
+  BITBUCKET_WEBHOOK_URL: "{{ include "scheme" . }}://{{ $webhookHost }}/webhook/bitbucket/"
   {{- end }}
 
   ENABLE_BLOBVAULT: "True"
@@ -43,8 +43,8 @@ data:
   {{- else }}
   BLOBVAULT_LOCAL_ENABLED: "True"
   BLOBVAULT_LOCAL_PATH: "/blobvault"
-  BLOBVAULT_ENDPOINT_URL: "{{include "ingress.protocol" . }}://{{.Values.global.host }}{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}/{{ include "studio.basePath" . }}{{- end }}/blobvault"
-  BLOBVAULT_ENDPOINT_URL_FE: "{{include "ingress.protocol" . }}://{{.Values.global.host }}{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}/{{ include "studio.basePath" . }}{{- end }}/blobvault"
+  BLOBVAULT_ENDPOINT_URL: "{{ include "scheme" . }}://{{.Values.global.host }}{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}/{{ include "studio.basePath" . }}{{- end }}/blobvault"
+  BLOBVAULT_ENDPOINT_URL_FE: "{{ include "scheme" . }}://{{.Values.global.host }}{{- if and .Values.global.basePath (not (eq .Values.global.basePath "/")) }}/{{ include "studio.basePath" . }}{{- end }}/blobvault"
   {{- end }}
 
   {{- if .Values.global.celery.brokerUrl }}
@@ -75,7 +75,7 @@ data:
   GITHUB_URL: {{ .Values.global.scmProviders.github.url | quote }}
   {{- end }}
   {{- if and .Values.global.scmProviders.github.enabled $webhookHost }}
-  GITHUB_WEBHOOK_URL: "{{include "ingress.protocol" . }}://{{ $webhookHost }}/webhook/github/"
+  GITHUB_WEBHOOK_URL: "{{ include "scheme" . }}://{{ $webhookHost }}/webhook/github/"
   {{- end }}
   {{- if .Values.global.scmProviders.github.clientId }}
   GITHUB_APP_CLIENT_ID: {{ .Values.global.scmProviders.github.clientId | quote }}
@@ -94,7 +94,7 @@ data:
   GITLAB_URL: {{ .Values.global.scmProviders.gitlab.url | quote}}
   {{- end }}
   {{- if and .Values.global.scmProviders.gitlab.enabled $webhookHost }}
-  GITLAB_WEBHOOK_URL: "{{include "ingress.protocol" . }}://{{ $webhookHost }}/webhook/gitlab/"
+  GITLAB_WEBHOOK_URL: "{{ include "scheme" . }}://{{ $webhookHost }}/webhook/gitlab/"
   {{- end }}
 
   {{- if .Values.global.maxViews }}
@@ -118,18 +118,18 @@ data:
 
   SOCIAL_AUTH_REDIRECT_IS_HTTPS: "False"
 
-  {{- if .Values.global.ingress.enabled }}
+  {{- if .Values.global.host }}
   SOCIAL_AUTH_ALLOWED_REDIRECT_HOSTS: "studio-ui.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.studioUi.service.port }},studio-backend.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.studioBackend.service.port }},{{ .Values.global.host }}"
   {{- else }}
   SOCIAL_AUTH_ALLOWED_REDIRECT_HOSTS: "studio-ui.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.studioUi.service.port }},studio-backend.{{ .Release.Namespace }}.svc.cluster.local:{{ .Values.studioBackend.service.port }}"
   {{- end }}
 
   {{- $dvcx := .Values.global.dvcx | default dict }}
   {{- $dvcxClickhouse := $dvcx.clickHouse | default dict }}
-  DQL_ENABLED: {{ $dvcx.enabled | default "False" | quote }}
-  DQL_UDF_ENABLED: {{ $dvcx.udfEnabled | default "False" | quote }}
-  DVCX_ENABLED: {{ $dvcx.enabled | default "False" | quote }}
-  DVCX_UDF_ENABLED: {{ $dvcx.udfEnabled | default "False" | quote }}
+  DQL_ENABLED: {{ $dvcx.enabled | default false | quote | title }}
+  DQL_UDF_ENABLED: {{ $dvcx.udfEnabled | default false | quote | title }}
+  DVCX_ENABLED: {{ $dvcx.enabled | default false | quote | title }}
+  DVCX_UDF_ENABLED: {{ $dvcx.udfEnabled | default false | quote | title }}
   {{- if ((.Values.ray).enabled) }}
   DVCX_RAY_URL: "http://{{ .Release.Name }}-ray-head-svc.{{ .Release.Namespace }}.svc.cluster.local:8265"
   {{- end }}

diff --git a/charts/studio/templates/deployment-studio-backend.yaml b/charts/studio/templates/deployment-studio-backend.yaml
@@ -32,7 +32,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "studio.serviceAccountName" . }}
+      serviceAccountName: {{ include "studio-backend.serviceAccountName" . }}
       securityContext:
         fsGroup: 103
         fsGroupChangePolicy: "OnRootMismatch"

diff --git a/charts/studio/templates/deployment-studio-dvcx-worker.yaml b/charts/studio/templates/deployment-studio-dvcx-worker.yaml
@@ -34,7 +34,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "studio.serviceAccountName" . }}
+      serviceAccountName: {{ include "studio-dvcx-worker.serviceAccountName" . }}
       terminationGracePeriodSeconds: 150
       securityContext:
         fsGroup: 103
@@ -71,6 +71,15 @@ spec:
             - secretRef:
                 name: {{ .Values.studioDvcxWorker.envFromSecret }}
             {{- end }}
+          livenessProbe:
+            exec:
+              command:
+                - python
+                - -c
+                - 'from viewer.utils import sqlalchemy_liveness_probe; sqlalchemy_liveness_probe()'
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 10
           volumeMounts:
             {{- if not .Values.global.blobvault.bucket }}
             - name: blobvault

diff --git a/charts/studio/templates/deployment-studio-ui.yaml b/charts/studio/templates/deployment-studio-ui.yaml
@@ -45,6 +45,13 @@ spec:
             - name: http
               containerPort: 3000
               protocol: TCP
+          startupProbe:
+            exec:
+              command:
+                - /app/bin/startup-probe.sh
+            initialDelaySeconds: 2
+            periodSeconds: 1
+            failureThreshold: 60
           livenessProbe:
             tcpSocket:
               port: 3000

diff --git a/charts/studio/templates/deployment-studio-worker.yaml b/charts/studio/templates/deployment-studio-worker.yaml
@@ -30,7 +30,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      serviceAccountName: {{ include "studio.serviceAccountName" . }}
+      serviceAccountName: {{ include "studio-worker.serviceAccountName" . }}
       terminationGracePeriodSeconds: 180
       securityContext:
         fsGroup: 103

diff --git a/charts/studio/templates/ingress-blobvault-nginx.yaml b/charts/studio/templates/ingress-blobvault-nginx.yaml
@@ -35,7 +35,6 @@ spec:
       secretName: {{ .tlsSecretName }}
   {{- end }}
   {{- end }}
-
   rules:
     - http:
         paths:

diff --git a/charts/studio/templates/serviceaccount-backend.yaml b/charts/studio/templates/serviceaccount-backend.yaml
@@ -0,0 +1,12 @@
+{{- if ((.Values.studioBackend).serviceAccount).create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "studio-backend.serviceAccountName" . }}
+  labels:
+    {{- include "studio-backend.labels" . | nindent 4 }}
+  {{- with .Values.studioBackend.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/studio/templates/serviceaccount-dvcx-worker.yaml b/charts/studio/templates/serviceaccount-dvcx-worker.yaml
@@ -0,0 +1,12 @@
+{{- if ((.Values.studioDvcxWorker).serviceAccount).create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "studio-dvcx-worker.serviceAccountName" . }}
+  labels:
+    {{- include "studio-dvcx-worker.labels" . | nindent 4 }}
+  {{- with .Values.studioDvcxWorker.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
diff --git a/charts/studio/templates/serviceaccount-worker.yaml b/charts/studio/templates/serviceaccount-worker.yaml
@@ -0,0 +1,12 @@
+{{- if ((.Values.studioWorker).serviceAccount).create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "studio-worker.serviceAccountName" . }}
+  labels:
+    {{- include "studio-worker.labels" . | nindent 4 }}
+  {{- with .Values.studioWorker.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
-Original file line number
+Diff line change
@@ Expand Up / @@ -35,7 +35,6 @@ spec: @@
           secretName: {{ .tlsSecretName }}
       {{- end }}
       {{- end }}
       rules:
         - http:
             paths:
@@ Expand Down @@