updated template manifests: service-account.yaml to handle get,list,w…

[Bianco95]

This pull request introduces enhancements to both the service account permissions and the virtual node network configuration for interlink. The main changes include expanding Kubernetes RBAC rules to allow more operations on secrets and additional resources, and adding support for ingress TLS configuration in the virtual node setup.

RBAC (Role-Based Access Control) updates:

• Added replicasets to the list of resources the service account can manage within the apps API group.
• Expanded permissions on secrets to include get, list, watch, and delete verbs, allowing the service account to read and manage secrets.

Virtual node network configuration enhancements:

• Introduced new configuration options ingressTLS (to enable TLS for ingress) and ingressClusterIssuer (to specify a ClusterIssuer for TLS certificates) in both virtual-kubelet-config.yaml and values.yaml. [1] [2]

[Copilot]

Pull request overview

This PR updates the interLink Helm chart to (1) expand the virtual-node ServiceAccount’s RBAC permissions and (2) pass new ingress TLS-related network settings into the virtual-kubelet configuration.

Changes:

• Expanded ClusterRole rules (adds replicasets; expands secrets verbs).
• Added ingressTLS and ingressClusterIssuer values under virtualNode.network.
• Propagated the new ingress TLS settings into the rendered InterLinkConfig.yaml for the virtual kubelet.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
interlink/values.yaml	Adds new virtualNode.network values for ingress TLS configuration.
interlink/templates/virtual-kubelet-config.yaml	Renders the new TLS-related network fields into the virtual-kubelet config map.
interlink/templates/service-account.yaml	Expands ClusterRole permissions (including secrets access changes).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Bianco95]

if IngressTLS is on, the -tls secret si deleted by the virtual kubelet when there is a pod deletion.
Without the delete on secrets for the ClusterRole, the virtual node will not be able to cleanup things properly

[dciangot]

in which namespace will the tls secret be created? Is there a way to reduce it to a namespace only?

[Bianco95]

The tls secret is created in the same namespace as the Ingress. The namespace can be:

• When default shadow mode a dedicated namespace -wstunnel
• When interlink.eu/shadow-same-ns: "true" the pod's own namespace

A shared namespace for all shadow resources maybe can be a solution but it rquires code changes VK side and for some specific use cases, like ISTIO, this would be a problem since it requires the offloaded pod and the shadow pod run in the same namespace (and therefore, the TLS created in the same namespace).

In any case, to avoid having the ClusterRole enabling the VK SA to delete secrets, it can be enabled only when ingressTLS is true

{{- if .Values.virtualNode.network.ingressTLS }}
# Clean up cert-manager-issued TLS secrets for tunnel ingresses
- delete
{{- end }}