@intentius/chant-lexicon-helm 0.124.30 → 0.124.32

package/dist/config.js

@@ -0,0 +1,161 @@
+/**
+ * Helm capability profiles — the `helm` namespace in `chant.config.ts` (#1235,
+ * epic #1228 Phase 1).
+ *
+ * `helm template` looks like a pure function of (chart, values) and is not:
+ * `.Capabilities.KubeVersion` defaults to a version baked into the helm
+ * binary (v1.31.0 on helm 3.16.2, v1.35.0 on 4.1.1), and
+ * `.Capabilities.APIVersions` is silently empty offline. Two engineers on
+ * different helm versions therefore render different bytes from identical
+ * inputs unless the capability profile is declared. Declaring it closes both
+ * inputs: `--kube-version` and `--api-versions` are passed on every render
+ * that references a profile, so the render is a function of
+ * (chart, values, profile) and its digest means something.
+ *
+ * Profiles are scoped **per cluster** (see the epic's Decisions): each
+ * cluster declares its own `kubeVersion` / `apiVersions`, and a render is
+ * pinned against exactly one profile. This mirrors how the k8s lexicon binds
+ * environments to clusters (`k8s.profiles.<env>.context`, chant #1100) — a
+ * capability profile is the same per-cluster fact seen from the render side.
+ *
+ * ```ts
+ * export default {
+ *   lexicons: ["helm", "k8s"],
+ *   helm: {
+ *     capabilityProfiles: {
+ *       prod: { kubeVersion: "1.33.6", apiVersions: ["monitoring.coreos.com/v1"] },
+ *       staging: { kubeVersion: "1.31.4", apiVersions: [] },
+ *     },
+ *   },
+ * };
+ * ```
+ *
+ * A `HelmRender` references a profile by name (`capabilityProfile: "prod"`)
+ * or carries one inline. No profile keeps today's unpinned behavior; a
+ * reference that resolves to nothing is a build error naming the profile —
+ * never a silent fallback to the binary's default.
+ *
+ * Follows the k8s lexicon's config seam (#1344): the zod schema is the
+ * runtime half core validates the namespace with, the interface is the
+ * compile-time half projects write `satisfies` against, and the agreement
+ * type at the bottom keeps the two from drifting.
+ */
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+import { findProjectConfig } from "@intentius/chant/project-root";
+import { evaluateProjectConfigSync } from "@intentius/chant/config-sandbox";
+/**
+ * What `--kube-version` accepts: `1.33`, `1.33.6`, `v1.33.6`. Deliberately
+ * looser than full semver (no prerelease/build tags — helm's capability
+ * parsing does not want them) and tighter than "any string" (a typo like
+ * `"latest"` must fail at declaration, not render as garbage).
+ */
+export const KUBE_VERSION_PATTERN = /^v?\d+\.\d+(\.\d+)?$/;
+export const helmCapabilityProfileSchema = z.strictObject({
+    kubeVersion: z
+        .string()
+        .regex(KUBE_VERSION_PATTERN, 'must be a Kubernetes version like "1.33.6" or "v1.33"'),
+    apiVersions: z.array(z.string().min(1, "apiVersions entries must be non-empty strings")).optional(),
+});
+/** What a `helm.charts` key may be: it names the generated factory. */
+export const CHART_KEY_PATTERN = /^[A-Za-z][A-Za-z0-9_-]*$/;
+export const helmProjectChartSchema = z.union([
+    z.strictObject({
+        repo: z.string().url().optional(),
+        chart: z.string().min(1),
+        version: z.string().min(1),
+        digest: z.string().optional(),
+    }),
+    z.strictObject({ path: z.string().min(1) }),
+]);
+export const helmConfigSchema = z.strictObject({
+    capabilityProfiles: z.record(z.string(), helmCapabilityProfileSchema).optional(),
+    charts: z
+        .record(z.string().regex(CHART_KEY_PATTERN, "must start with a letter and hold only letters, digits, - and _"), helmProjectChartSchema)
+        .optional(),
+});
+/**
+ * Validate a resolved profile's fields. Returns one message per problem,
+ * each naming the profile — empty when the profile is sound.
+ *
+ * Config-declared profiles are already schema-checked at config load
+ * (`helmConfigSchema` via the plugin's `configSchema`); this covers inline
+ * profiles handed straight to `HelmRender`, and re-checks resolved ones so a
+ * config loaded outside the CLI (a bare API caller) fails identically.
+ */
+export function validateCapabilityProfile(profile) {
+    const errors = [];
+    const label = typeof profile.name === "string" && profile.name.length > 0 ? `"${profile.name}"` : "(unnamed)";
+    if (typeof profile.name !== "string" || profile.name.length === 0) {
+        errors.push("helm capability profile: name must be a non-empty string");
+    }
+    if (typeof profile.kubeVersion !== "string" || !KUBE_VERSION_PATTERN.test(profile.kubeVersion)) {
+        errors.push(`helm capability profile ${label}: kubeVersion must be a Kubernetes version like "1.33.6" or "v1.33", got ${JSON.stringify(profile.kubeVersion)}`);
+    }
+    if (profile.apiVersions !== undefined) {
+        if (!Array.isArray(profile.apiVersions)) {
+            errors.push(`helm capability profile ${label}: apiVersions must be an array of non-empty strings`);
+        }
+        else {
+            for (const entry of profile.apiVersions) {
+                if (typeof entry !== "string" || entry.length === 0) {
+                    errors.push(`helm capability profile ${label}: apiVersions entries must be non-empty strings, got ${JSON.stringify(entry)}`);
+                }
+            }
+        }
+    }
+    return errors;
+}
+/**
+ * Synchronously load the nearest project config's raw object, walking upward
+ * from `startDir` exactly like `loadChantConfigUpward` (`findProjectConfig`
+ * is the shared walk). Synchronous because `HelmRender` resolves at synth
+ * time inside a composite factory — the same constraint that gave
+ * `chant lint` `evaluateProjectConfigSync`, which this reuses so the
+ * sandbox boundary (chant #1113) stays in one place.
+ */
+function loadProjectConfigSync(startDir) {
+    const { dir, configPath } = findProjectConfig(startDir);
+    if (!configPath)
+        return { config: {} };
+    if (configPath.endsWith(".json")) {
+        return { config: JSON.parse(readFileSync(configPath, "utf8")), configPath };
+    }
+    return { config: evaluateProjectConfigSync(configPath, dir), configPath };
+}
+/**
+ * Resolve a `HelmRender`'s profile reference to a concrete profile.
+ *
+ * - An inline profile object is validated and returned as-is.
+ * - A string is looked up in `helm.capabilityProfiles` of the nearest
+ *   `chant.config.ts`/`.json` above `opts.startDir` (default: cwd).
+ *
+ * A reference that resolves to nothing throws, naming the missing profile,
+ * the profiles that ARE declared, and where to declare it — a declared but
+ * unresolvable profile must be a build error, never a silent fall-through to
+ * the helm binary's default capabilities (epic #1228, finding 1).
+ */
+export function resolveCapabilityProfile(ref, opts) {
+    if (typeof ref !== "string") {
+        const errors = validateCapabilityProfile(ref);
+        if (errors.length > 0)
+            throw new Error(errors.join("\n"));
+        return ref;
+    }
+    const startDir = opts?.startDir ?? process.cwd();
+    const { config, configPath } = loadProjectConfigSync(startDir);
+    const profiles = config.helm?.capabilityProfiles;
+    const declared = profiles?.[ref];
+    if (!declared) {
+        const names = Object.keys(profiles ?? {});
+        const where = configPath ?? `chant.config.ts (no config found above ${startDir})`;
+        throw new Error(`helm capability profile "${ref}" is not declared` +
+            (names.length > 0 ? ` — declared profiles: ${names.join(", ")}` : "") +
+            `. Declare it as helm.capabilityProfiles.${ref} = { kubeVersion, apiVersions } in ${where}.`);
+    }
+    const profile = { name: ref, ...declared };
+    const errors = validateCapabilityProfile(profile);
+    if (errors.length > 0)
+        throw new Error(errors.join("\n"));
+    return profile;
+}

package/dist/coverage.js

@@ -0,0 +1,37 @@
+/**
+ * Coverage analysis for the Helm lexicon.
+ *
+ * Since Helm types are static and few, coverage is inherently high.
+ * This module provides a consistent interface with other lexicons.
+ */
+import { readFileSync } from "fs";
+import { join, dirname } from "path";
+import { fileURLToPath } from "url";
+const pkgDir = dirname(dirname(fileURLToPath(import.meta.url)));
+/**
+ * Analyze coverage of the Helm lexicon.
+ */
+export async function analyzeHelmCoverage(opts) {
+    const generatedDir = join(pkgDir, "src", "generated");
+    let lexiconData;
+    try {
+        const raw = readFileSync(join(generatedDir, "lexicon-helm.json"), "utf-8");
+        lexiconData = JSON.parse(raw);
+    }
+    catch {
+        console.error("Helm lexicon coverage: generated artifacts not found. Run 'just generate' first.");
+        process.exit(1);
+        return;
+    }
+    const typeCount = Object.keys(lexiconData).length;
+    const resources = Object.values(lexiconData).filter((e) => e.kind === "resource").length;
+    const properties = Object.values(lexiconData).filter((e) => e.kind === "property").length;
+    // Helm types are fully statically defined, so coverage is 100%
+    const pct = 100;
+    console.error(`Helm lexicon coverage: ${pct}%`);
+    console.error(`  Types: ${typeCount} (${resources} resources, ${properties} properties)`);
+    if (opts?.minOverall && pct < opts.minOverall) {
+        console.error(`Coverage ${pct}% is below minimum ${opts.minOverall}%`);
+        process.exit(1);
+    }
+}

package/dist/deep-observe-hooks.js

@@ -0,0 +1,19 @@
+/**
+ * The helm lexicon's deep-observation noise rules (#1247) — the k8s
+ * lexicon's, by reference.
+ *
+ * Everything a Helm release deploys is a Kubernetes object, so the rules for
+ * which fields are server-populated, which defaults are noise, which arrays
+ * are sets, and which Secret paths must be masked are exactly the k8s
+ * lexicon's `k8sDeepNormalizationHooks`. This is deliberately the same
+ * *object*, not a copy: core applies `deepNormalizationHooks` to the
+ * declared tree as well as the live one (`lexicon.ts`), and two lists would
+ * drift apart the first time one gained a rule.
+ *
+ * Static-import safe for the same reason the k8s module is: the hooks file
+ * carries no `@intentius/chant-k8s-client` dependency, so `plugin.ts` can
+ * expose it as plain data without pulling the live-read machinery into the
+ * build path.
+ */
+import { k8sDeepNormalizationHooks } from "@intentius/chant-lexicon-k8s/deep-observe-hooks";
+export const helmDeepNormalizationHooks = k8sDeepNormalizationHooks;

package/dist/deep-observe.js

@@ -0,0 +1,55 @@
+import { deepObservation } from "@intentius/chant/deep-observation";
+import { unobservedAll } from "@intentius/chant/observation";
+import { observeResourcesDeepK8s } from "@intentius/chant-lexicon-k8s/deep-observe";
+import { defaultHelmRunner, observeReleases, } from "./release-observe.js";
+/** The document minus the envelope the row's `type` already carries. */
+function declaredTreeOf(doc, namespace) {
+    const { apiVersion: _apiVersion, kind: _kind, ...rest } = doc;
+    const metadata = (rest.metadata ?? {});
+    return {
+        ...rest,
+        // The k8s reader addresses the object by `props.metadata.{name,namespace}`;
+        // helm applies the release namespace to namespace-silent documents, so the
+        // synthetic entity must carry the resolved one.
+        metadata: { ...metadata, ...(namespace && metadata.namespace === undefined ? { namespace } : {}) },
+    };
+}
+export async function observeResourcesDeepHelm(options, deps = {}) {
+    const run = deps.run ?? defaultHelmRunner;
+    let observed;
+    try {
+        observed = await observeReleases({ environment: options.environment, entities: options.entities, stack: options.stack }, run);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return deepObservation({}, unobservedAll(options.entityNames, "read-failed", message, options.entities));
+    }
+    const unobserved = { ...observed.unobserved };
+    // One synthetic declared entity per rendered document, keyed like the thin
+    // read's rows so the two reads spell the same identity for the same object.
+    const synthetic = new Map();
+    for (const release of observed.releases) {
+        for (const row of release.resources) {
+            synthetic.set(row.key, {
+                entityType: row.entityType,
+                props: declaredTreeOf(row.doc, row.namespace),
+            });
+        }
+    }
+    if (synthetic.size === 0)
+        return deepObservation({}, unobserved);
+    const k8sOptions = {
+        environment: options.environment,
+        buildOutput: options.buildOutput,
+        entityNames: [...synthetic.keys()],
+        entities: synthetic,
+        ...(options.owned !== undefined ? { owned: options.owned } : {}),
+    };
+    const k8sResult = deps.connect
+        ? await observeResourcesDeepK8s(k8sOptions, deps.connect)
+        : await observeResourcesDeepK8s(k8sOptions);
+    return deepObservation(k8sResult.resources ?? {}, {
+        ...(k8sResult.unobserved ?? {}),
+        ...unobserved,
+    });
+}

package/dist/describe-resources.js

@@ -0,0 +1,119 @@
+import { observation } from "@intentius/chant/observation";
+import { LABEL_OWNERSHIP_KEYS, readOwnership } from "@intentius/chant/ownership";
+import { HELM_CHART_ENTITY_TYPE, HELM_RELEASE_TYPE, defaultHelmRunner, observeReleases, } from "./release-observe.js";
+function pruneUndefined(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined)
+            out[k] = v;
+    }
+    return out;
+}
+function releaseRow(release) {
+    return {
+        type: HELM_RELEASE_TYPE,
+        physicalId: `${release.namespace}/${release.release}`,
+        status: release.status ?? "unknown",
+        ...(release.updated ? { lastUpdated: release.updated } : {}),
+        ownership: "owned",
+        attributes: pruneUndefined({
+            chart: release.chart,
+            revision: release.revision,
+            appVersion: release.appVersion,
+            namespace: release.namespace,
+            resources: release.resources.length,
+        }),
+    };
+}
+export async function describeResources(options, run = defaultHelmRunner) {
+    const satellites = [];
+    for (const [entityName, entity] of options.entities) {
+        if (entity.entityType !== HELM_CHART_ENTITY_TYPE) {
+            satellites.push({ entityName, entityType: entity.entityType });
+        }
+    }
+    const observed = await observeReleases({ environment: options.environment, entities: options.entities, stack: options.stack }, run);
+    const chartCount = options.entities.size - satellites.length;
+    const resources = {};
+    const unobserved = { ...observed.unobserved };
+    const notes = [];
+    if (chartCount === 0 && satellites.length > 0) {
+        for (const { entityName, entityType } of satellites) {
+            unobserved[entityName] = {
+                type: entityType,
+                reason: "unsupported-kind",
+                detail: "chart-authoring entity with no declared Helm::Chart to attribute a release to",
+            };
+        }
+        return observation(resources, unobserved, observed.queried, notes);
+    }
+    for (const release of observed.releases) {
+        resources[release.entityName] = releaseRow(release);
+        for (const row of release.resources) {
+            const labels = row.doc.metadata?.labels;
+            const marker = readOwnership(labels, LABEL_OWNERSHIP_KEYS);
+            resources[row.key] = {
+                type: row.entityType,
+                physicalId: row.namespace ? `${row.namespace}/${row.name}` : row.name,
+                status: release.status ?? "unknown",
+                // Owned via release identity (#1246): the read is scoped to a release
+                // this project declares, so every document it returns is helm-managed
+                // by construction — the release IS the marker channel here.
+                ownership: "owned",
+                ...(marker ? { marker } : {}),
+                // The release's resources are what the declared chart deploys —
+                // expected runtime, never orphan/delete candidates (#1077).
+                ownerChain: { root: "declared", entity: release.entityName },
+                attributes: pruneUndefined({
+                    release: release.release,
+                    releaseNamespace: release.namespace,
+                    namespace: row.namespace,
+                    channel: row.channel,
+                    hook: row.hook?.hook,
+                    hookWeight: row.hook?.weight,
+                    hookDeletePolicy: row.hook?.deletePolicy,
+                }),
+            };
+        }
+    }
+    // Chart-authoring satellites ride the single chart's verdict; see the
+    // module doc. Their deployed form is the release itself, so the release
+    // read is the honest answer for them — present, absent, or unobserved
+    // exactly as the chart is.
+    if (satellites.length > 0) {
+        if (chartCount === 1) {
+            const [chartEntity] = [...options.entities].find(([, e]) => e.entityType === HELM_CHART_ENTITY_TYPE);
+            const release = observed.releases.find((r) => r.entityName === chartEntity);
+            const hole = unobserved[chartEntity];
+            for (const { entityName, entityType } of satellites) {
+                if (release) {
+                    resources[entityName] = {
+                        type: entityType,
+                        physicalId: `${release.namespace}/${release.release}`,
+                        status: release.status ?? "unknown",
+                        ownership: "owned",
+                        attributes: { release: release.release, namespace: release.namespace, via: "release-identity" },
+                    };
+                }
+                else if (hole) {
+                    unobserved[entityName] = { type: entityType, reason: hole.reason, ...(hole.detail ? { detail: hole.detail } : {}) };
+                }
+                // Release confirmed absent → the satellite is absent too: in neither
+                // map, and deploying the chart is what creates it.
+            }
+        }
+        else {
+            for (const { entityName, entityType } of satellites) {
+                unobserved[entityName] = {
+                    type: entityType,
+                    reason: "unsupported-kind",
+                    detail: "chart-authoring entity in a multi-chart project — cannot attribute it to a single release",
+                };
+            }
+        }
+    }
+    if (options.owned) {
+        notes.push("helm scopes reads to declared releases, so every row is helm-managed (owned) by construction — --owned withholds nothing");
+    }
+    return observation(resources, unobserved, observed.queried, notes);
+}

package/dist/describe-stack-status.js

@@ -0,0 +1,66 @@
+/**
+ * Deploy-unit status for Helm (#1495 piece 4).
+ *
+ * A Helm deploy unit *is* a release: `helm list` already reports its
+ * presence, revision, and native status, and that status lands on
+ * `StackStatusObservation` almost field-for-field — `deployed` is the one
+ * terminal success state, so `healthy` is exactly `status === "deployed"`.
+ * This reads back what `helm-upgrade` (the paired capability) writes, the
+ * same one-name-both-jobs pairing `cfn-deploy`/`kubectl-apply` have.
+ *
+ * Tri-state, matching the k8s observer's contract:
+ *  - release found        → `{ present: true, status, healthy }`
+ *  - release not in list  → `{ present: false }` (pre-first-install)
+ *  - helm missing, no cluster, exec failure, unparseable output → `null` —
+ *    "I cannot tell", never a confident absence.
+ *
+ * Cluster selection follows #1488: the environment's declared k8s binding
+ * (`k8s.profiles.<env>.context`) is passed as `--kube-context` when present;
+ * ambient otherwise. A Helm release lives on the same cluster the k8s half
+ * observes, so it rides the same binding.
+ */
+import { exec } from "node:child_process";
+import { promisify } from "node:util";
+import { loadChantConfigUpward } from "@intentius/chant/config";
+import { resolveClusterTarget } from "@intentius/chant/kubectl-context";
+const execAsync = promisify(exec);
+export async function describeStackStatus(options, run = execAsync) {
+    // The unit is a release name, optionally namespace-qualified as
+    // "<namespace>/<name>" when the same release name exists in two namespaces.
+    const slash = options.stack.indexOf("/");
+    const wantNs = slash > 0 ? options.stack.slice(0, slash) : undefined;
+    const wantName = slash > 0 ? options.stack.slice(slash + 1) : options.stack;
+    let context;
+    try {
+        const { config } = await loadChantConfigUpward(process.cwd());
+        context = (await resolveClusterTarget(config, options.environment, "helm")).context;
+    }
+    catch {
+        context = undefined;
+    }
+    let stdout;
+    try {
+        ({ stdout } = await run(`helm list -A -o json${context ? ` --kube-context '${context.replace(/'/g, "'\\''")}'` : ""}`));
+    }
+    catch {
+        // Binary missing, no kubeconfig, cluster unreachable — indeterminate.
+        return null;
+    }
+    let entries;
+    try {
+        entries = JSON.parse(stdout);
+        if (!Array.isArray(entries))
+            return null;
+    }
+    catch {
+        return null;
+    }
+    const found = entries.find((e) => e.name === wantName && (wantNs === undefined || e.namespace === wantNs));
+    if (!found)
+        return { stack: options.stack, present: false };
+    return {
+        stack: options.stack,
+        present: true,
+        ...(found.status ? { status: found.status, healthy: found.status === "deployed" } : {}),
+    };
+}

package/dist/detect.js

@@ -0,0 +1,11 @@
+/** Edge-safe template detection for helm (Chart.yaml) — see #426. */
+export function detectTemplate(data) {
+    if (typeof data !== "object" || data === null)
+        return false;
+    const obj = data;
+    // Helm charts have apiVersion: v2 in Chart.yaml
+    if (obj.apiVersion === "v2" && typeof obj.name === "string" && typeof obj.version === "string") {
+        return true;
+    }
+    return false;
+}

package/dist/generated/index.js

@@ -0,0 +1,11 @@
+// Auto-generated Helm lexicon runtime index
+// Do not edit manually
+import { createResource, createProperty } from "@intentius/chant/runtime";
+export const Chart = createResource("Helm::Chart", "helm", {});
+export const Values = createResource("Helm::Values", "helm", {});
+export const HelmTest = createResource("Helm::Test", "helm", {});
+export const HelmNotes = createResource("Helm::Notes", "helm", {});
+export const HelmHook = createProperty("Helm::Hook", "helm");
+export const HelmDependency = createProperty("Helm::Dependency", "helm");
+export const HelmMaintainer = createProperty("Helm::Maintainer", "helm");
+export const HelmCRD = createResource("Helm::CRD", "helm", {});

package/dist/helpers.js

@@ -0,0 +1,84 @@
+/**
+ * _helpers.tpl generation for Helm charts.
+ *
+ * Generates the standard named templates that Helm charts typically include:
+ * chart name, fullname, labels, selectorLabels, chart metadata, serviceAccountName.
+ */
+/**
+ * Generate the _helpers.tpl content for a Helm chart.
+ */
+export function generateHelpers(config) {
+    const { chartName, includeServiceAccount = true } = config;
+    const lines = [];
+    // Chart name
+    lines.push(`{{/*
+Expand the name of the chart.
+*/}}
+{{- define "${chartName}.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}`);
+    // Fullname
+    lines.push(`
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "${chartName}.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}`);
+    // Chart label
+    lines.push(`
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "${chartName}.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}`);
+    // Common labels
+    lines.push(`
+{{/*
+Common labels
+*/}}
+{{- define "${chartName}.labels" -}}
+helm.sh/chart: {{ include "${chartName}.chart" . }}
+{{ include "${chartName}.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}`);
+    // Selector labels
+    lines.push(`
+{{/*
+Selector labels
+*/}}
+{{- define "${chartName}.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "${chartName}.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}`);
+    // Service account name
+    if (includeServiceAccount) {
+        lines.push(`
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "${chartName}.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "${chartName}.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}`);
+    }
+    return lines.join("\n") + "\n";
+}