Add support for serviceAccountName on deploy (#1842)

This allows setting the service account for the resulting knative service, which must pre-exist in the namespace to let the deployment succeed. Signed-off-by: Sascha Grunert <[email protected]> Co-authored-by: Sascha Grunert <[email protected]>
knative · Jul 5, 2023 · d540166 · d540166
1 parent 528c532
commit d540166
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 1 deletion.
diff --git a/docs/reference/func_yaml.md b/docs/reference/func_yaml.md
@@ -121,6 +121,14 @@ subsequent deployments.
 
 The Kubernetes namespace where your function will be deployed.
 
+
+### `serviceAccountName`
+
+The name of the service account used for the function pod. The service account
+must exist in the namespace to succeed.
+
+More info: https://k8s.io/docs/tasks/configure-pod-container/configure-service-account
+
 ### `options`
 Options allows you to set specific configuration for the deployed function, allowing you to tweak Knative Service options related to autoscaling and other properties. If these options are not set, the Knative defaults will be used. 
 - `scale`

diff --git a/pkg/functions/function.go b/pkg/functions/function.go
@@ -154,6 +154,12 @@ type DeploySpec struct {
 
 	// Health endpoints specified by the language pack
 	HealthEndpoints HealthEndpoints `yaml:"healthEndpoints,omitempty"`
+
+	// ServiceAccountName is the name of the service account used for the
+	// function pod. The service account must exist in the namespace to
+	// succeed.
+	// More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+	ServiceAccountName string `yaml:"serviceAccountName,omitempty"`
 }
 
 // HealthEndpoints specify the liveness and readiness endpoints for a Runtime

diff --git a/pkg/knative/deployer.go b/pkg/knative/deployer.go
@@ -366,7 +366,8 @@ func generateNewService(f fn.Function, decorator DeployDecorator) (*v1.Service,
 							Containers: []corev1.Container{
 								container,
 							},
-							Volumes: newVolumes,
+							ServiceAccountName: f.Deploy.ServiceAccountName,
+							Volumes:            newVolumes,
 						},
 					},
 				},

diff --git a/schema/func_yaml-schema.json b/schema/func_yaml-schema.json
@@ -86,6 +86,10 @@
 					"$schema": "http://json-schema.org/draft-04/schema#",
 					"$ref": "#/definitions/HealthEndpoints",
 					"description": "Health endpoints specified by the language pack"
+				},
+				"serviceAccountName": {
+					"type": "string",
+					"description": "ServiceAccountName is the name of the service account used for the\nfunction pod. The service account must exist in the namespace to\nsucceed.\nMore info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/"
 				}
 			},
 			"additionalProperties": false,