Inject K8s Node Labels into NATS Config

values.yaml

config:
  merge:
    $include: server-tags/tags.conf

container:
  patch:
  - op: add
    path: /volumeMounts/-
    value:
      name: server-tags
      mountPath: /etc/nats-config/server-tags

podTemplate:
  merge:
    spec:
      initContainers:
      - name: server-tags
        image:
          $tplYaml: >-
            bitnami/kubectl:{{ .Capabilities.KubeVersion.Major }}.{{ .Capabilities.KubeVersion.Minor }}
        command: ["sh", "-ec"]
        env:
        - name: NODE_NAME
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
        args:
        - |-
          kubectl get node "$NODE_NAME" --output json \
            | jq '{"server_tags": [ .metadata.labels | to_entries | .[] | .key + ":" + .value ]}' \
            > /server-tags/tags.conf
          echo "wrote server tags"
        volumeMounts:
        - name: server-tags
          mountPath: /server-tags
  patch:
  - op: add
    path: /spec/volumes/-
    value:
      name: server-tags
      emptyDir: {}

extraResources:
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name:
      $tplYaml: >-
        {{ include "nats.namespace" $ }}-{{ include "nats.fullname" $ }}-get-nodes
  rules:
  - apiGroups: [""]
    resources: ["nodes"]
    verbs: ["get"]
- apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRoleBinding
  metadata:
    name:
      $tplYaml: >-
        {{ include "nats.namespace" $ }}-{{ include "nats.fullname" $ }}-get-nodes-binding
  subjects:
  - kind: ServiceAccount
    name:
      $tplYaml: >-
        {{ .Values.serviceAccount.name }}
    namespace:
      $tplYaml: >-
        {{ include "nats.namespace" $ }}
  roleRef:
    kind: ClusterRole
    name:
      $tplYaml: >-
        {{ include "nats.namespace" $ }}-{{ include "nats.fullname" $ }}-get-nodes
    apiGroup: rbac.authorization.k8s.io

I found that the helm chart uses the default ServiceAccount.
So the ClusterRoleBinding has to be fixed:

kind: ClusterRoleBinding
  ...
  - kind: ServiceAccount
    name: default
  ...