[Internal] K8s Optimizer ServiceAccount 설정 지원

EKS Pod Identity / IRSA를 위한 serviceAccount 속성 추가.
podTemplate 미사용 시 Deployment spec에 serviceAccountName 설정 가능.

Signed-off-by: 박지원F <jiwonpark@tossinvest.com>

Author: 이해수

amoro-ams/src/main/java/org/apache/amoro/server/manager/KubernetesOptimizerContainer.java

@@ -68,6 +68,7 @@ public class KubernetesOptimizerContainer extends AbstractOptimizerContainer {
   public static final String PODTEMPLATE = "podTemplate";
   public static final String PULL_SECRETS = "imagePullSecrets";
   public static final String KUBE_CONFIG_PATH = "kube-config-path";
+  public static final String SERVICE_ACCOUNT = "serviceAccount";
 
   private static final String NAME_PREFIX = "amoro-optimizer-";
 
@@ -138,6 +139,7 @@ protected Map<String, String> doScaleOut(Resource resource) {
               memory,
               imagePullSecretsList);
     } else {
+      String serviceAccount = groupProperties.get(SERVICE_ACCOUNT);
       deployment =
           initPodTemplateWithoutConfig(
               image,
@@ -147,7 +149,8 @@ protected Map<String, String> doScaleOut(Resource resource) {
               resourceId,
               startUpArgs,
               memory,
-              imagePullSecretsList);
+              imagePullSecretsList,
+              serviceAccount);
     }
 
     client.apps().deployments().inNamespace(namespace).resource(deployment).create();
@@ -218,7 +221,8 @@ public Deployment initPodTemplateWithoutConfig(
       String resourceId,
       String startUpArgs,
       long memory,
-      List<LocalObjectReference> imagePullSecretsList) {
+      List<LocalObjectReference> imagePullSecretsList,
+      String serviceAccount) {
 
     DeploymentBuilder deploymentBuilder =
         new DeploymentBuilder()
@@ -234,6 +238,7 @@ public Deployment initPodTemplateWithoutConfig(
             .addToLabels("AmoroResourceId", resourceId)
             .endMetadata()
             .withNewSpec()
+            .withServiceAccountName(serviceAccount)
             .addNewContainer()
             .withName("optimizer")
             .withImage(image)

charts/amoro/values.yaml

@@ -284,6 +284,8 @@ optimizer:
       #kube-config-path: "~/.kube/config"
       image: "apache/amoro:latest"
       pullPolicy: "IfNotPresent"
+      # serviceAccount name for optimizer pods (required for EKS Pod Identity / IRSA)
+      #serviceAccount: "amoro-optimizer-sa"
   extra: []
 
 ## Configure the plugin that allows you to access the metric reporters and event listeners.