Add serviceAccountName to TidbInitializer (#6872)#6881
Add serviceAccountName to TidbInitializer (#6872)#6881ti-chi-bot wants to merge 1 commit intopingcap:release-1.6from
Conversation
FedRAMP Gatekeeper can reject pods that fall back to the default service account. TidbInitializer creates a Job pod directly, so the CRD needs an explicit field that users can bind to a dedicated ServiceAccount without carrying operator-side patches. The initializer spec now exposes serviceAccountName and passes it through to the generated Job pod template. The CRD and OpenAPI schema are updated so users can configure the field through the v1 API. Constraint: FedRAMP block-default-service-account policy rejects implicit default service account usage Rejected: Hardcode tidb-initializer in the manager | forces one service account name on all users and keeps requiring operator code patches Confidence: high Scope-risk: narrow Directive: Keep this field as a pass-through to the Job pod spec; do not add defaulting here without checking backward compatibility Tested: go test ./pkg/manager/member Tested: cd pkg/apis && go test ./pingcap/v1alpha1 Tested: git diff --check
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
/retest |
|
@ti-chi-bot: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
This is an automated cherry-pick of #6872
What problem does this PR solve?
FedRAMP Gatekeeper
block-default-service-accountpolicy rejects pods that use the default ServiceAccount. The TidbInitializer Job pod did not expose a way to setspec.serviceAccountName, so users had to patch operator code or rely on the default ServiceAccount.What is changed and how does it work?
This adds
spec.serviceAccountNametoTidbInitializerSpecand passes it through to the generated initializer Job pod template.The CRD/OpenAPI schema is updated so users can configure:
Check List
Tests
Side effects
Release note
Verification
go test ./pkg/manager/membercd pkg/apis && go test ./pingcap/v1alpha1git diff --check