{cmd,}/k8s-operator: support IRSA for Recorder resources (#15913)

Adds Recorder fields to configure the name and annotations of the ServiceAccount
created for and used by its associated StatefulSet. This allows the created Pod
to authenticate with AWS without requiring a Secret with static credentials,
using AWS' IAM Roles for Service Accounts feature, documented here:
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

Fixes #15875

Change-Id: Ib0e15c0dbc357efa4be260e9ae5077bacdcb264f
Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
This commit is contained in:
Tom Proctor
2025-05-19 11:35:05 +01:00
committed by GitHub
parent 6b97e615d6
commit d89aa29081
9 changed files with 359 additions and 25 deletions
@@ -838,6 +838,7 @@ func (in *RecorderPod) DeepCopyInto(out *RecorderPod) {
(*in)[i].DeepCopyInto(&(*out)[i])
}
}
in.ServiceAccount.DeepCopyInto(&out.ServiceAccount)
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RecorderPod.
@@ -850,6 +851,28 @@ func (in *RecorderPod) DeepCopy() *RecorderPod {
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *RecorderServiceAccount) DeepCopyInto(out *RecorderServiceAccount) {
*out = *in
if in.Annotations != nil {
in, out := &in.Annotations, &out.Annotations
*out = make(map[string]string, len(*in))
for key, val := range *in {
(*out)[key] = val
}
}
}
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new RecorderServiceAccount.
func (in *RecorderServiceAccount) DeepCopy() *RecorderServiceAccount {
if in == nil {
return nil
}
out := new(RecorderServiceAccount)
in.DeepCopyInto(out)
return out
}
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (in *RecorderSpec) DeepCopyInto(out *RecorderSpec) {
*out = *in