allow to change service accounts for worker and apps

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>

functions/onprem/orborus/orborus.go

@@ -75,9 +75,13 @@ var workerVersion = os.Getenv("SHUFFLE_WORKER_VERSION")
 var newWorkerImage = os.Getenv("SHUFFLE_WORKER_IMAGE")
 var dockerSwarmBridgeMTU = os.Getenv("SHUFFLE_SWARM_BRIDGE_DEFAULT_MTU")
 var dockerSwarmBridgeInterface = os.Getenv("SHUFFLE_SWARM_BRIDGE_DEFAULT_INTERFACE")
+var maxCPUPercent = 90
+
+// Kubernetes settings
 var isKubernetes = os.Getenv("IS_KUBERNETES")
 var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
-var maxCPUPercent = 90
+var workerServiceAccountName = os.Getenv("SHUFFLE_WORKER_SERVICE_ACCOUNT_NAME")
+var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
 
 // var baseimagename = "docker.pkg.github.com/shuffle/shuffle"
 // var baseimagename = "ghcr.io/frikky"
@@ -1000,6 +1004,10 @@ func deployK8sWorker(image string, identifier string, env []string) error {
 		env = append(env, fmt.Sprintf("SHUFFLE_USE_GHCR_OVERRIDE_FOR_AUTODEPLOY=%s", os.Getenv("SHUFFLE_USE_GHCR_OVERRIDE_FOR_AUTODEPLOY")))
 	}
 
+	if len(appServiceAccountName) > 0 {
+		env = append(env, fmt.Sprintf("SHUFFLE_APP_SERVICE_ACCOUNT_NAME=%s", appServiceAccountName))
+	}
+
 	clientset, _, err := shuffle.GetKubernetesClient()
 	if err != nil {
 		log.Printf("[ERROR] Error getting kubernetes client:", err)
@@ -1008,18 +1016,6 @@ func deployK8sWorker(image string, identifier string, env []string) error {
 
 	//env = append(env, fmt.Sprintf("KUBERNETES_CONFIG=%s", config.String()))
 
-	// FIXME: When a service account is used, the account is also mounted in the pod
-	// The volume mount location is:
-	// /var/run/secrets/kubernetes.io/serviceaccount
-
-	// Look for if there is a default service account in use
-	if len(os.Getenv("KUBERNETES_SERVICE_ACCOUNT")) > 0 {
-		log.Printf("[DEBUG] Using Kubernetes service account %s", os.Getenv("KUBERNETES_SERVICE_ACCOUNT"))
-		env = append(env, fmt.Sprintf("KUBERNETES_SERVICE_ACCOUNT=%s", os.Getenv("KUBERNETES_SERVICE_ACCOUNT")))
-
-		// use k8s downward API to find it if we are in a pod
-	}
-
 	// Check if namespace exist as variable. If so, make it
 	if len(os.Getenv("KUBERNETES_NAMESPACE")) > 0 && !namespacemade {
 		kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
@@ -1199,7 +1195,8 @@ func deployK8sWorker(image string, identifier string, env []string) error {
 					Containers: []corev1.Container{
 						containerAttachment,
 					},
-					DNSPolicy: corev1.DNSClusterFirst,
+					DNSPolicy:          corev1.DNSClusterFirst,
+					ServiceAccountName: workerServiceAccountName,
 				},
 			},
 		},
@@ -2296,7 +2293,7 @@ func main() {
 
 					// Manual command = overrides to allow starting of Tenzir from the frontend anyway.
 					os.Setenv("SHUFFLE_SKIP_PIPELINES", "false")
-					tenzirDisabled = false 
+					tenzirDisabled = false
 
 					// Removed either way
 					toBeRemoved.Data = append(toBeRemoved.Data, incRequest)
@@ -2306,7 +2303,7 @@ func main() {
 						if strings.Contains(fmt.Sprintf("%s", err), "node available") {
 							// Disabling until UI is updated
 							os.Setenv("SHUFFLE_SKIP_PIPELINES", "true")
-							tenzirDisabled = true 
+							tenzirDisabled = true
 
 							log.Printf("[ERROR] Failed to start tenzir, reason: %s", err)
 							err = shuffle.CreateOrgNotification(
@@ -2625,7 +2622,7 @@ func deployTenzirNode() error {
 		// return errors.New("Pipelines are disabled by user with SHUFFLE_SKIP_PIPELINES")
 		//log.Printf("[INFO] Pipelines are enabled by user")
 	} else {
-		return errors.New("Pipelines are disabled by user with SHUFFLE_SKIP_PIPELINES") 
+		return errors.New("Pipelines are disabled by user with SHUFFLE_SKIP_PIPELINES")
 	}
 
 	if isKubernetes == "true" {
@@ -2825,12 +2822,12 @@ func createAndStartTenzirNode(ctx context.Context, containerName, imageName stri
 		},
 	}
 
-	// FIXME: Is this necessary? Seems to screw up networking: 
+	// FIXME: Is this necessary? Seems to screw up networking:
 	// conflicting options: hostname and the network mode
 	/*
-	if isKubernetes != "true" && os.Getenv("SHUFFLE_SWARM_CONFIG") != "run" {
+		if isKubernetes != "true" && os.Getenv("SHUFFLE_SWARM_CONFIG") != "run" {
-		hostConfig.NetworkMode = container.NetworkMode(fmt.Sprintf("container:%s", containerId))
+			hostConfig.NetworkMode = container.NetworkMode(fmt.Sprintf("container:%s", containerId))
-	}
+		}
 	*/
 
 	resp, err := dockercli.ContainerCreate(ctx, config, hostConfig, networkingConfig, nil, containerName)

functions/onprem/worker/worker.go

@@ -56,6 +56,7 @@ var logsDisabled = os.Getenv("SHUFFLE_LOGS_DISABLED")
 var cleanupEnv = strings.ToLower(os.Getenv("CLEANUP"))
 var swarmNetworkName = os.Getenv("SHUFFLE_SWARM_NETWORK_NAME")
 var dockerApiVersion = strings.ToLower(os.Getenv("DOCKER_API_VERSION"))
+var appServiceAccountName = os.Getenv("SHUFFLE_APP_SERVICE_ACCOUNT_NAME")
 
 var baseimagename = "frikky/shuffle"
 var kubernetesNamespace = os.Getenv("KUBERNETES_NAMESPACE")
@@ -105,11 +106,11 @@ var window = shuffle.NewTimeWindow(10 * time.Second)
 
 // Images to be autodeployed in the latest version of Shuffle.
 var autoDeploy = map[string]string{
-	"http:1.4.0":               "frikky/shuffle:http_1.4.0",
+	"http:1.4.0":            "frikky/shuffle:http_1.4.0",
-	"http:1.3.0":               "frikky/shuffle:http_1.3.0",
+	"http:1.3.0":            "frikky/shuffle:http_1.3.0",
-	"shuffle-tools:1.2.0":      "frikky/shuffle:shuffle-tools_1.2.0",
+	"shuffle-tools:1.2.0":   "frikky/shuffle:shuffle-tools_1.2.0",
-	"shuffle-subflow:1.0.0":    "frikky/shuffle:shuffle-subflow_1.0.0",
+	"shuffle-subflow:1.0.0": "frikky/shuffle:shuffle-subflow_1.0.0",
-	"shuffle-subflow:1.1.0":    "frikky/shuffle:shuffle-subflow_1.1.0",
+	"shuffle-subflow:1.1.0": "frikky/shuffle:shuffle-subflow_1.1.0",
 	// "shuffle-tools-fork:1.0.0": "frikky/shuffle:shuffle-tools-fork_1.0.0",
 }
 
@@ -592,6 +593,8 @@ func deployk8sApp(image string, identifier string, env []string) error {
 							Env:   buildEnvVars(envMap),
 						},
 					},
+					DNSPolicy:          corev1.DNSClusterFirst,
+					ServiceAccountName: appServiceAccountName},
 				},
 			},
 		},