fix helpers script for UI chart and docs

charts/postgres-operator-ui/templates/_helpers.tpl

@@ -24,6 +24,13 @@ If release name contains chart name it will be used as a full name.
 {{- end -}}
 {{- end -}}
 
+{{/*
+Create a service account name.
+*/}}
+{{- define "postgres-operator-ui.serviceAccountName" -}}
+{{ default (include "postgres-operator-ui.fullname" .) .Values.serviceAccount.name }}
+{{- end -}}
+
 {{/*
 Create chart name and version as used by the chart label.
 */}}

charts/postgres-operator/templates/clusterrole.yaml

@@ -54,8 +54,8 @@ rules:
   - get
   - list
   - patch
-  - update  # needed if postgres-operator account is used for pods as well
+  - update
-  - watch  # needed if postgres-operator account is used for pods as well
+  - watch
 # to CRUD secrets for database access
 - apiGroups:
   - ""

docs/reference/operator_parameters.md

@@ -162,12 +162,12 @@ configuration they are grouped under the `kubernetes` key.
   default is empty.
 
 * **pod_service_account_role_binding_definition**
-  This definition must bind pod service account to a role with permission
+  This definition must bind the pod service account to a role with permission
   sufficient for the pods to start and for Patroni to access K8s endpoints;
   service account on its own lacks any such rights starting with K8s v1.8. If
   not explicitly defined by the user, a simple definition that binds the
-  account to the operator's own 'postgres-operator' cluster role will be used.
+  account to the 'postgres-pod' [cluster role](../../manifests/operator-service-account-rbac.yaml#L198)
-  The default is empty.
+  will be used. The default is empty.
 
 * **pod_terminate_grace_period**
   Postgres pods are [terminated forcefully](https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods)

manifests/operator-service-account-rbac.yaml

@@ -55,8 +55,8 @@ rules:
   - get
   - list
   - patch
-  - update  # needed if postgres-operator account is used for pods as welle
+  - update
-  - watch  # needed if postgres-operator account is used for pods as well
+  - watch
 # to CRUD secrets for database access
 - apiGroups:
   - ""