Rename consul client daemonset. (#1000)

CHANGELOG.md

@@ -3,7 +3,7 @@
 BREAKING CHANGES:
 * Helm
   * Some Consul components from the Helm chart have been renamed to ensure consistency in naming across the components.
-  This will not be a breaking change if Consul components are not referred to by name externally. Check the PR for the list of renamed components. [[GH-993](https://github.com/hashicorp/consul-k8s/pull/993)]
+  This will not be a breaking change if Consul components are not referred to by name externally. Check the PR for the list of renamed components. [[GH-993](https://github.com/hashicorp/consul-k8s/pull/993)][[GH-1000](https://github.com/hashicorp/consul-k8s/pull/1000)]
 
 FEATURES:
 * Helm
@@ -18,6 +18,7 @@ IMPROVEMENTS:
   * Allow using dash-separated names for config entries when using `kubectl`. [[GH-965](https://github.com/hashicorp/consul-k8s/pull/965)]
   * Support Pod Security Policies with Vault integration. [[GH-985](https://github.com/hashicorp/consul-k8s/pull/985)]
   * Rename Consul resources to remove resource kind suffixes from the resource names to standardize resource names across the Helm chart. [[GH-993](https://github.com/hashicorp/consul-k8s/pull/993)]
+  * Append `-client` to the Consul Daemonset name to standardize resource names across the Helm chart. [[GH-1000](https://github.com/hashicorp/consul-k8s/pull/1000)]
 * CLI
   * Show a diff when upgrading a Consul installation on Kubernetes [[GH-934](https://github.com/hashicorp/consul-k8s/pull/934)]
 * Control Plane

acceptance/tests/connect/connect_inject_test.go

@@ -143,8 +143,8 @@ func TestConnectInject_RestartConsulClients(t *testing.T) {
 	}
 
 	logger.Log(t, "restarting Consul client daemonset")
-	k8s.RunKubectl(t, ctx.KubectlOptions(t), "rollout", "restart", fmt.Sprintf("ds/%s-consul", releaseName))
-	k8s.RunKubectl(t, ctx.KubectlOptions(t), "rollout", "status", fmt.Sprintf("ds/%s-consul", releaseName))
+	k8s.RunKubectl(t, ctx.KubectlOptions(t), "rollout", "restart", fmt.Sprintf("ds/%s-consul-client", releaseName))
+	k8s.RunKubectl(t, ctx.KubectlOptions(t), "rollout", "status", fmt.Sprintf("ds/%s-consul-client", releaseName))
 
 	logger.Log(t, "checking that connection is still successful")
 	if cfg.EnableTransparentProxy {

charts/consul/templates/client-daemonset.yaml

@@ -11,7 +11,7 @@
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
-  name: {{ template "consul.fullname" . }}
+  name: {{ template "consul.fullname" . }}-client
   namespace: {{ .Release.Namespace }}
   labels:
     app: {{ template "consul.name" . }}

charts/consul/templates/connect-inject-authmethod-clusterrolebinding.yaml

@@ -18,23 +18,5 @@ subjects:
   - kind: ServiceAccount
     name: {{ template "consul.fullname" . }}-connect-injector
     namespace: {{ .Release.Namespace }}
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: {{ template "consul.fullname" . }}-connect-injector
-  labels:
-    app: {{ template "consul.name" . }}
-    chart: {{ template "consul.chart" . }}
-    heritage: {{ .Release.Service }}
-    release: {{ .Release.Name }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: {{ template "consul.fullname" . }}-connect-injector
-subjects:
-  - kind: ServiceAccount
-    name: {{ template "consul.fullname" . }}-connect-injector
-    namespace: {{ .Release.Namespace }}
 {{- end }}
 {{- end }}

charts/consul/templates/connect-inject-clusterrole.yaml

@@ -11,6 +11,13 @@ metadata:
     release: {{ .Release.Name }}
     component: connect-injector
 rules:
+{{- if .Values.global.acls.manageSystemACLs }}
+- apiGroups: [""]
+  resources:
+  - serviceaccounts
+  verbs:
+  - get
+{{- end }}
 - apiGroups: [""]
   resources: ["pods", "endpoints", "services", "namespaces"]
   verbs: