remove environmentd_iam_role_arn from v1alpha2

Author: alex-hunt-materialize

src/cloud-resources/src/crd/materialize.rs

@@ -287,7 +287,7 @@ pub mod v1alpha1 {
                     environmentd_image_ref: value.spec.environmentd_image_ref,
                     environmentd_extra_args: value.spec.environmentd_extra_args,
                     environmentd_extra_env: value.spec.environmentd_extra_env,
-                    environmentd_iam_role_arn: value.spec.environmentd_iam_role_arn,
+                    environmentd_iam_role_arn: None,
                     environmentd_connection_role_arn: value.spec.environmentd_connection_role_arn,
                     environmentd_resource_requirements: value
                         .spec
@@ -374,16 +374,6 @@ pub mod v1alpha2 {
         pub environmentd_extra_args: Option<Vec<String>>,
         /// Extra environment variables to pass to the environmentd binary.
         pub environmentd_extra_env: Option<Vec<EnvVar>>,
-        /// {{<warning>}}
-        /// Deprecated.
-        ///
-        /// Use `service_account_annotations` to set "eks.amazonaws.com/role-arn" instead.
-        /// {{</warning>}}
-        ///
-        /// If running in AWS, override the IAM role to use to give
-        /// environmentd access to the persist S3 bucket.
-        #[kube(deprecated)]
-        pub environmentd_iam_role_arn: Option<String>,
         /// If running in AWS, override the IAM role to use to support
         /// the CREATE CONNECTION feature.
         pub environmentd_connection_role_arn: Option<String>,
@@ -505,7 +495,6 @@ pub mod v1alpha2 {
                 environmentd_image_ref: self.spec.environmentd_image_ref.clone(),
                 environmentd_extra_args: self.spec.environmentd_extra_args.clone(),
                 environmentd_extra_env: self.spec.environmentd_extra_env.clone(),
-                environmentd_iam_role_arn: self.spec.environmentd_iam_role_arn.clone(),
                 environmentd_connection_role_arn: self
                     .spec
                     .environmentd_connection_role_arn
@@ -965,13 +954,23 @@ pub mod v1alpha2 {
     impl From<v1alpha1::Materialize> for Materialize {
         fn from(value: v1alpha1::Materialize) -> Self {
             let is_promoting = value.is_promoting();
+            let service_account_annotations = if let Some(environmentd_iam_role_arn) =
+                value.spec.environmentd_iam_role_arn
+            {
+                let mut annotations = value.spec.service_account_annotations.unwrap_or_default();
+                annotations
+                    .entry("eks.amazonaws.com/role-arn".to_owned())
+                    .or_insert(environmentd_iam_role_arn);
+                Some(annotations)
+            } else {
+                value.spec.service_account_annotations
+            };
             let mut mz = Materialize {
                 metadata: value.metadata,
                 spec: MaterializeSpec {
                     environmentd_image_ref: value.spec.environmentd_image_ref,
                     environmentd_extra_args: value.spec.environmentd_extra_args,
                     environmentd_extra_env: value.spec.environmentd_extra_env,
-                    environmentd_iam_role_arn: value.spec.environmentd_iam_role_arn,
                     environmentd_connection_role_arn: value.spec.environmentd_connection_role_arn,
                     environmentd_resource_requirements: value
                         .spec
@@ -984,7 +983,7 @@ pub mod v1alpha2 {
                     balancerd_replicas: value.spec.balancerd_replicas,
                     console_replicas: value.spec.console_replicas,
                     service_account_name: value.spec.service_account_name,
-                    service_account_annotations: value.spec.service_account_annotations,
+                    service_account_annotations,
                     service_account_labels: value.spec.service_account_labels,
                     pod_annotations: value.spec.pod_annotations,
                     pod_labels: value.spec.pod_labels,

src/orchestratord/src/controller/materialize/global.rs

@@ -7,8 +7,6 @@
 // the Business Source License, use of this software will be governed
 // by the Apache License, Version 2.0.
 
-use std::collections::BTreeMap;
-
 use k8s_openapi::{
     api::{
         core::v1::ServiceAccount,
@@ -23,12 +21,11 @@ use k8s_openapi::{
 use kube::{Api, Client, ResourceExt, api::ObjectMeta, runtime::controller::Action};
 use maplit::btreemap;
 use serde::Serialize;
-use tracing::{trace, warn};
+use tracing::trace;
 
 use super::Error;
 use crate::k8s::apply_resource;
 use crate::tls::create_certificate;
-use mz_cloud_provider::CloudProvider;
 use mz_cloud_resources::crd::materialize::v1alpha2::Materialize;
 use mz_cloud_resources::crd::{
     ManagedResource,
@@ -49,7 +46,7 @@ impl Resources {
     pub fn new(config: &super::Config, mz: &Materialize) -> Self {
         let environmentd_network_policies = create_environmentd_network_policies(config, mz);
 
-        let service_account = Box::new(create_service_account_object(config, mz));
+        let service_account = Box::new(create_service_account_object(mz));
         let role = Box::new(create_role_object(mz));
         let role_binding = Box::new(create_role_binding_object(mz));
         let environmentd_certificate = Box::new(create_environmentd_certificate(config, mz));
@@ -284,37 +281,21 @@ fn create_environmentd_network_policies(
     network_policies
 }
 
-fn create_service_account_object(
-    config: &super::Config,
-    mz: &Materialize,
-) -> Option<ServiceAccount> {
+fn create_service_account_object(mz: &Materialize) -> Option<ServiceAccount> {
     if mz.create_service_account() {
-        let mut annotations: BTreeMap<String, String> = mz
+        let annotations = mz
             .spec
             .service_account_annotations
             .clone()
             .unwrap_or_default();
-        if let (CloudProvider::Aws, Some(role_arn)) = (
-            config.cloud_provider,
-            mz.spec
-                .environmentd_iam_role_arn
-                .as_deref()
-                .or(config.environmentd_iam_role_arn.as_deref()),
-        ) {
-            warn!(
-                "Use of Materialize.spec.environmentd_iam_role_arn is deprecated. Please set \"eks.amazonaws.com/role-arn\" in Materialize.spec.service_account_annotations instead."
-            );
-            annotations.insert(
-                "eks.amazonaws.com/role-arn".to_string(),
-                role_arn.to_string(),
-            );
-        };
 
         let mut labels = mz.default_labels();
         labels.extend(mz.spec.service_account_labels.clone().unwrap_or_default());
 
         Some(ServiceAccount {
             metadata: ObjectMeta {
+                // Explicitly using Some here even if they don't have any defined,
+                // to handle when the user removes annotations/labels.
                 annotations: Some(annotations),
                 labels: Some(labels),
                 ..mz.managed_resource_meta(mz.service_account_name())